From f2c821e9b317fa9ba004d4394d1d9f906a773b07 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Tue, 3 Sep 2024 11:10:44 -0600 Subject: [PATCH 01/16] Build for EPEL --- .gitignore | 1 + sources | 1 + zabbix-agent.service | 11 + zabbix-config.patch | 48 ++ zabbix-configure-sscanf.patch | 17 + zabbix-crypto-policy.patch | 44 ++ zabbix-fedora-epel.README | 217 ++++++++ zabbix-logrotate.in | 8 + zabbix-out-of-tree.patch | 157 ++++++ zabbix-php-fpm.conf | 24 + zabbix-proxy-mysql.service | 11 + zabbix-proxy-pgsql.service | 11 + zabbix-proxy-sqlite3.service | 11 + zabbix-server-mysql.service | 11 + zabbix-server-pgsql.service | 11 + zabbix-tmpfiles-zabbix.conf | 1 + zabbix-tmpfiles-zabbixsrv.conf | 1 + zabbix-web.conf | 35 ++ zabbix.fc | 25 + zabbix.if | 199 ++++++++ zabbix.te | 374 ++++++++++++++ zabbix7.0.spec | 876 +++++++++++++++++++++++++++++++++ 22 files changed, 2094 insertions(+) create mode 100644 .gitignore create mode 100644 sources create mode 100644 zabbix-agent.service create mode 100644 zabbix-config.patch create mode 100644 zabbix-configure-sscanf.patch create mode 100644 zabbix-crypto-policy.patch create mode 100644 zabbix-fedora-epel.README create mode 100644 zabbix-logrotate.in create mode 100644 zabbix-out-of-tree.patch create mode 100644 zabbix-php-fpm.conf create mode 100644 zabbix-proxy-mysql.service create mode 100644 zabbix-proxy-pgsql.service create mode 100644 zabbix-proxy-sqlite3.service create mode 100644 zabbix-server-mysql.service create mode 100644 zabbix-server-pgsql.service create mode 100644 zabbix-tmpfiles-zabbix.conf create mode 100644 zabbix-tmpfiles-zabbixsrv.conf create mode 100644 zabbix-web.conf create mode 100644 zabbix.fc create mode 100644 zabbix.if create mode 100644 zabbix.te create mode 100644 zabbix7.0.spec diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d3bfa98 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/zabbix-7.0.3.tar.gz diff --git a/sources b/sources new file mode 100644 index 0000000..de4962e --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (zabbix-7.0.3.tar.gz) = 22149415712017c2fb504972c9673623ea710842611644a934a9f555685a73e516ecbad566048b5ec05ba6404000687feee0815e7b2c8a04fb8fd154c9539671 diff --git a/zabbix-agent.service b/zabbix-agent.service new file mode 100644 index 0000000..aeed01b --- /dev/null +++ b/zabbix-agent.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix Monitor Agent +After=syslog.target network.target + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_agentd -f +User=zabbix + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-config.patch b/zabbix-config.patch new file mode 100644 index 0000000..5d61074 --- /dev/null +++ b/zabbix-config.patch @@ -0,0 +1,48 @@ +diff --git a/ui/include/classes/core/CConfigFile.php b/ui/include/classes/core/CConfigFile.php +index d7ad93a..88b7d5f 100644 +--- a/ui/include/classes/core/CConfigFile.php ++++ b/ui/include/classes/core/CConfigFile.php +@@ -20,7 +20,7 @@ class CConfigFile { + const CONFIG_ERROR = 2; + const CONFIG_VAULT_ERROR = 3; + +- const CONFIG_FILE_PATH = '/conf/zabbix.conf.php'; ++ const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php'; + + private static $supported_db_types = [ + ZBX_DB_MYSQL => true, +diff --git a/ui/include/classes/core/ZBase.php b/ui/include/classes/core/ZBase.php +index 51b2165..e57e5a8 100644 +--- a/ui/include/classes/core/ZBase.php ++++ b/ui/include/classes/core/ZBase.php +@@ -392,7 +392,7 @@ class ZBase { + * @throws Exception + */ + protected function setMaintenanceMode() { +- require_once 'conf/maintenance.inc.php'; ++ require_once '/etc/zabbix/web/maintenance.inc.php'; + + if (defined('ZBX_DENY_GUI_ACCESS')) { + if (!isset($ZBX_GUI_ACCESS_IP_RANGE) || !in_array(CWebUser::getIp(), $ZBX_GUI_ACCESS_IP_RANGE)) { +@@ -405,7 +405,7 @@ class ZBase { + * Load zabbix config file. + */ + protected function loadConfigFile(): void { +- $configFile = $this->root_dir.CConfigFile::CONFIG_FILE_PATH; ++ $configFile = CConfigFile::CONFIG_FILE_PATH; + + $config = new CConfigFile($configFile); + +diff --git a/ui/include/classes/setup/CSetupWizard.php b/ui/include/classes/setup/CSetupWizard.php +index 8574868..79d0c72 100644 +--- a/ui/include/classes/setup/CSetupWizard.php ++++ b/ui/include/classes/setup/CSetupWizard.php +@@ -328,7 +328,7 @@ class CSetupWizard extends CForm { + // make zabbix.conf.php downloadable + header('Content-Type: application/x-httpd-php'); + header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"'); +- $config = new CConfigFile(APP::getRootDir().CConfigFile::CONFIG_FILE_PATH); ++ $config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH); + $config->config = [ + 'DB' => [ + 'TYPE' => $this->getConfig('DB_TYPE'), diff --git a/zabbix-configure-sscanf.patch b/zabbix-configure-sscanf.patch new file mode 100644 index 0000000..8117635 --- /dev/null +++ b/zabbix-configure-sscanf.patch @@ -0,0 +1,17 @@ +sscanf needs for the prototype. Submitted upstream here: + + + +diff --git a/configure.ac b/configure.ac +index 0588004f9f89cdd5..bbc60e3a28369f9f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -952,6 +952,7 @@ dnl FreeBSD 4.x does not support %llu + AC_MSG_CHECKING(for long long format) + AC_RUN_IFELSE([AC_LANG_SOURCE([[ + #include ++#include + int main() + { + uint64_t i; + diff --git a/zabbix-crypto-policy.patch b/zabbix-crypto-policy.patch new file mode 100644 index 0000000..cf06a65 --- /dev/null +++ b/zabbix-crypto-policy.patch @@ -0,0 +1,44 @@ +diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go +index be8cf4a..e68b435 100644 +--- a/src/go/pkg/tls/tls.go ++++ b/src/go/pkg/tls/tls.go +@@ -393,7 +393,7 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch + goto out; + #endif + +- if (1 != SSL_CTX_set_cipher_list(ctx, ciphers)) ++ if (1 != SSL_CTX_set_cipher_list(ctx, "PROFILES=SYSTEM")) + goto out; + + ret = 0; +diff --git a/src/libs/zbxcomms/tls_openssl.c b/src/libs/zbxcomms/tls_openssl.c +index 40394a3..b2eb0f0 100644 +--- a/src/libs/zbxcomms/tls_openssl.c ++++ b/src/libs/zbxcomms/tls_openssl.c +@@ -1212,7 +1212,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type + goto out; + } + } +- else if (1 != SSL_CTX_set_cipher_list(ctx_cert, ciphers)) ++ else if (1 != SSL_CTX_set_cipher_list(ctx_cert, "PROFILE=SYSTEM")) + { + zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of certificate" + " ciphersuites:"); +@@ -1302,7 +1302,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type + goto out; + } + } +- else if (1 != SSL_CTX_set_cipher_list(ctx_psk, ciphers)) ++ else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILES=SYSTEM")) + { + zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of PSK ciphersuites:"); + goto out; +@@ -1360,7 +1360,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type + goto out; + } + } +- else if (1 != SSL_CTX_set_cipher_list(ctx_all, ciphers)) ++ else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILES=SYSTEM")) + { + zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of all ciphersuites:"); + goto out; diff --git a/zabbix-fedora-epel.README b/zabbix-fedora-epel.README new file mode 100644 index 0000000..38268ad --- /dev/null +++ b/zabbix-fedora-epel.README @@ -0,0 +1,217 @@ +=Custom in Fedora/EPEL= + +==Pinger files== + +Since /tmp is not a good place to spool files, the pinger files shall now reside +in /var/lib/zabbixsrv/tmp. This directory is automatically created and proxy and +server configuration files are changed accordingly from 2.0.8 on. + + +==Web configuration== + +Web configuration resides in /etc/zabbix/web. The configuration file can be +created manually or by walking through the frontend setup tool, as soon as your +httpd configuration allows. The directory also contains maintenance.inc.php! + + +==Log files== + +Log files are located in /var/log/zabbix for the agent and /var/log/zabbixsrv. +for server and proxy. + + +==No htaccess files== + +Fedora ships an Apache configuration file instead. This solutions performs +better and is easier to maintain. + + +==Two users and groups== + +There's a certain security risk involved, running agent and proxy/server as the +same user. This package therefore introduces an additional zabbixsrv user, used +for proxy and server. Please check the permissions of your scripts and group +memberships, if necessary. + + +==Using the Alternatives system instead of conflicting sub-packages== + +You can now install Zabbix proxies or servers compiled for different database +back-ends on the same system. While this is not intended to happily switch back +and forth, it allows you to: + +- Stop the daemon +- "Run alternatives --config zabbix-server" or + "alternatives --config zabbix-proxy" +- Make your choice +- If you're using systemd, run systemctl reload +- Adjust the configuration file +- Start the daemon +- In some cases you have to use "restart" instead of "start". + The reason is not yet clear to me. + +"Alternatives" considers the first installed implementation of server or proxy as +default, respectively. + +Don't forget to reconfigure the front-end when you switch the server to a +different DB implementation! + + +==How to run multiple instances of a Zabbix daemon with init scripts== + +If you want to run multiple instances on the same host, do the following: + +- Copy or symlink the init scripts +- Create a file of the same name as the new init script in /etc/sysconfig +- Define CFG_FILE="" in this file +- Create the file defined as CFG_FILE and adjust settings; in particular: + - DB settings if you set up multiple instances of server and proxy daemons; + IMPORTANT: Two daemons using the same database at the same time could act + destructive! + - PidFile + - ListenPort and/or ListenIP, if you plan for simultaneous operation; + Don't forget to review your firewall settings! + - LogFile, if you don't use syslog +- Optionally run the following to register the new instance as a service and + start it up automatically: + chkconfig --add + chkconfig on +- service start + + +==Configuration changes== + +Zabbix 2.0 and later place configuration files directly in /etc. Symlinks preserve +compatibility. maintenance.inc.php moved from /usr/share/zabbix/conf to +/etc/zabbix/web. Be careful not to replace the symlinks with files by mistake, +as the agent will not pick them up! + + +==Media scripts and external scripts== + +The directories for external scripts and media scripts have moved to +/var/lib/zabbixsrv. Symlinks preserve compatibility. + +/var/lib/zabbix is now intended for scripts run by the agent. Please move your +server or proxy scripts to /var/lib/zabbixsrv. Be sure to check permissions and +ownership. + + +==No Java bridge== + +The Zabbix Java bridge can not be included now, due to missing dependencies. + + +=SELinux= + +The settings necessary for you vary, depending on how you set up your system/s. +Most of the time, the only adjustments necessary should be on the machine that +holds the frontend: + +#Allow to connect the frontend to a database by other means than sockets +setsebool -P httpd_can_network_connect_db 1 + +#Allow the frontend to create a connection to the server listening port +#That's the check the frontend uses to see whether the server is running. +#This option effectively supersedes the previous +setsebool -P httpd_can_network_connect 1 + +Using sebools is a somewhat coarse method of allowing things. +A more fine-grained approach for the latter would be to grab an actual +avc denial from the audit log, pipe it through audit2allow, put it in a +module package and load that: + +echo "avc: denied { name_connect } for pid=20619 comm="httpd" dest=10051 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:zabbix_port_t:s0 tclass=tcp_socket" | audit2allow -M zabbix_conn_httpd; sudo semodule -i zabbix_conn_httpd.pp + +If you're using ping from the frontend: + +echo "avc: denied { setpgid } for pid=31880 comm="zabbix_server_p" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process" | audit2allow -M zabbix_ping_frontend; sudo semodule -i zabbix_ping_frontend.pp + + +=Additional packaging changes in Fedora/EPEL since 3.0= + +==Configuration files contain the actual defaults== +Previously, the defaults in the config file were replaced by settings that +are suitable for Fedora. For non-mandatory settings, the daemon would default +to the hardcoded setting though, which is confusing. To make this +obvious, the original default settings are left in place and additional lines +added instead. + +==Daemons are running in the foreground mode== +Systemd is more happy with this and it also solves the problem for the pidfile +setting, described in BZ #1220392. It is related to the above-mentioned. + +==Minimal PHP configuration== +The httpd configuration contains the minimal settings necessary to operate +the frontend. Please refer to the manual for details: +https://www.zabbix.com/documentation/3.0/manual/installation/install + +Make sure to review these settings! + + +=Additional packaging changes in Fedora/EPEL since 2.0= + +==Zabbix 2.2 conflicts 1.8 and 2.0== + +Please see the below section for the reason! + + +==Agent init script/unit file name== +For the sake of consistency between distributions, the agent init script, +respectively the systemd unit file, was renamed to zabbix-agentd -- mind the +trailing "d"! Symlinks with the old names are in place. Keep in mind, if +you created a configuration file in /etc/sysconfig, the sourced file must +the name of the init script you invoke! Consequently, if you decide to use +zabbix-agentd in the future, copy or symlink this file. + + +==zabbixsrv now has its own user group== + +zabbixsrv used to be a member of the zabbix user group. Completely fresh +installations will create the zabbixsrv group and assign it as the primary +group. If the user zabbixsrv already exists (upgrade from 2.0), the user group +is replaced. + + +==Log and lock file locations, group membership== + +All logs used to be in /var/log/zabbix. With zabbixsrv having its own +user group, the logs are now split between /var/log/zabbix for the agent and +/var/log/zabbixsrv for server and proxy. + + +=Additional packaging changes in Fedora/EPEL since 1.8= + +==Zabbix 2.0 packages conflict Zabbix 1.8; 2.2 conflicts 1.8 and 2.0== + +This measure was taken because this major version introduces various database +schema changes. A silent update would render Zabbix non-operational and possibly +break the database. Besides that, Zabbix 2.0/2.2 server only works with the +respective major versions of servers and proxies. Distributed setups must +therefore be updated at the same time to keep working. + +http://www.zabbix.com/documentation/2.0/manual/appendix/compatibility +http://www.zabbix.com/documentation/2.2/manual/appendix/compatibility + +-------------------------------------------------------------------------------- + +=Guide for upgrading to 2.2 from 2.0= + +https://www.zabbix.com/documentation/2.2/manual/installation/upgrade +https://www.zabbix.com/documentation/2.2/manual/installation/upgrade_notes_220 + +Be sure to read the upgrades notes of the latest minor release too! + +- Review all rpmnew and rpmsave files; merge where necessary +- Review permissions, ownerships and group memberships for zabbixsrv +- Migrate server and proxy logs to the new location, if you want +- Back up the Zabbix database (really!) +- Remove custom database changes, if any +- Make sure the database user has sufficing permissions + (ALTER TABLE, DROP INDEX, DROP TABLE, ...) +- Start the server +- Check the server log for progress and possible errors + The schema conversion should finish within minutes or hours + + +Volker Fröhlich volker27@gmx.at Jan 5 2013 diff --git a/zabbix-logrotate.in b/zabbix-logrotate.in new file mode 100644 index 0000000..6eeea97 --- /dev/null +++ b/zabbix-logrotate.in @@ -0,0 +1,8 @@ +/var/log/USER/zabbix_COMPONENT.log { + missingok + monthly + notifempty + compress + copytruncate + su USER USER +} diff --git a/zabbix-out-of-tree.patch b/zabbix-out-of-tree.patch new file mode 100644 index 0000000..901d716 --- /dev/null +++ b/zabbix-out-of-tree.patch @@ -0,0 +1,157 @@ +diff --git a/src/go/Makefile.am b/src/go/Makefile.am +index 3e24aa0..308e34b 100644 +--- a/src/go/Makefile.am ++++ b/src/go/Makefile.am +@@ -67,6 +67,7 @@ clean: clean-go-build clean-sbom + + clean-go-build: + -$(GO) clean ./... ++ -$(GO) clean $(srcdir)/... + -rm -f bin/mock_server + -rm -f bin/zabbix_agent2 + -rm -f bin/zabbix_web_service +@@ -89,9 +90,9 @@ install-bin/zabbix_agent2: bin/zabbix_agent2 + $(INSTALL) -d "$(DESTDIR)$(sbindir)" + $(INSTALL_PROGRAM) bin/zabbix_agent2 "$(DESTDIR)$(sbindir)" + $(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)" +- $(INSTALL_DATA) conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)" ++ $(INSTALL_DATA) $(top_srcdir)/src/go/conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)" + $(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)" +- (cd conf/zabbix_agent2.d/plugins.d && \ ++ (cd $(top_srcdir)/conf/zabbix_agent2.d/plugins.d && \ + for _f in *.conf; do \ + $(INSTALL_DATA) $${_f} "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"; \ + done) +diff --git a/src/zabbix_agent/Makefile.am b/src/zabbix_agent/Makefile.am +index b217fb5..945a673 100644 +--- a/src/zabbix_agent/Makefile.am ++++ b/src/zabbix_agent/Makefile.am +@@ -69,4 +69,4 @@ zabbix_agentd_CFLAGS = \ + install-data-hook: + $(MKDIR_P) "$(DESTDIR)$(AGENT_CONFIG_FILE).d" + $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" +- test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "../../conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" ++ test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" +diff --git a/src/zabbix_java/Makefile.am b/src/zabbix_java/Makefile.am +index 43f8f19..48214c9 100644 +--- a/src/zabbix_java/Makefile.am ++++ b/src/zabbix_java/Makefile.am +@@ -9,22 +9,22 @@ EXTRA_DIST = \ + startup.sh + + ZJG = bin/zabbix-java-gateway-$(VERSION).jar +-LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.2.9.jar:lib/logback-classic-1.2.9.jar:lib/slf4j-api-1.7.32.jar +-JUNIT = tests/junit-4.8.2.jar ++LIB = $(srcdir)/lib/android-json-4.3_r3.1.jar:$(srcdir)/lib/logback-core-1.2.3.jar:$(srcdir)/lib/logback-classic-1.2.3.jar:$(srcdir)/lib/slf4j-api-1.7.30.jar ++JUNIT = $(srcdir)/tests/junit-4.8.2.jar + + ZJG_DEST = $(DESTDIR)$(sbindir)/zabbix_java + + all: $(ZJG) + +-$(ZJG): class src/com/zabbix/gateway/*.java +- $(JAVAC) -d class/src -classpath $(LIB) src/com/zabbix/gateway/*.java ++$(ZJG): class $(srcdir)/src/com/zabbix/gateway/*.java ++ $(JAVAC) -d class/src -classpath $(LIB) $(srcdir)/src/com/zabbix/gateway/*.java + $(JAR) cf $(ZJG) -C class/src . + + test: class + echo "badger useruser" > tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password + chmod 600 tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password +- $(JAVAC) tests/com/zabbix/gateway/jmx_test_beans/*.java +- $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) tests/com/zabbix/gateway/*.java ++ $(JAVAC) tests/com/zabbix/gateway/jmx_$(srcdir)/test_beans/*.java ++ $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) $(srcdir)/tests/com/zabbix/gateway/*.java + java -classpath class/tests:$(LIB):$(ZJG):$(JUNIT) com.zabbix.gateway.AllTestRunner + + class: +diff --git a/src/zabbix_js/Makefile.am b/src/zabbix_js/Makefile.am +index 1e4fd93..2110656 100644 +--- a/src/zabbix_js/Makefile.am ++++ b/src/zabbix_js/Makefile.am +@@ -5,30 +5,30 @@ + zabbix_js_SOURCES = zabbix_js.c + + zabbix_js_LDADD = \ +- $(top_srcdir)/src/libs/zbxlog/libzbxlog.a \ +- $(top_srcdir)/src/libs/zbxembed/libzbxembed.a \ +- $(top_srcdir)/src/libs/zbxjson/libzbxjson.a \ +- $(top_srcdir)/src/libs/zbxregexp/libzbxregexp.a \ +- $(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \ +- $(top_srcdir)/src/libs/zbxthreads/libzbxthreads.a \ +- $(top_srcdir)/src/libs/zbxmutexs/libzbxmutexs.a \ +- $(top_srcdir)/src/libs/zbxprof/libzbxprof.a \ +- $(top_srcdir)/src/libs/zbxnix/libzbxnix.a \ +- $(top_srcdir)/src/libs/zbxcomms/libzbxcomms.a \ +- $(top_srcdir)/src/libs/zbxip/libzbxip.a \ +- $(top_srcdir)/src/libs/zbxgetopt/libzbxgetopt.a \ +- $(top_srcdir)/src/libs/zbxhash/libzbxhash.a \ +- $(top_srcdir)/src/libs/zbxcrypto/libzbxcrypto.a \ +- $(top_srcdir)/src/libs/zbxcompress/libzbxcompress.a \ +- $(top_srcdir)/src/libs/zbxhttp/libzbxhttp.a \ +- $(top_srcdir)/src/libs/zbxvariant/libzbxvariant.a \ +- $(top_srcdir)/src/libs/zbxxml/libzbxxml.a \ +- $(top_srcdir)/src/libs/zbxstr/libzbxstr.a \ +- $(top_srcdir)/src/libs/zbxnum/libzbxnum.a \ +- $(top_srcdir)/src/libs/zbxtime/libzbxtime.a \ +- $(top_srcdir)/src/libs/zbxcommon/libzbxcommon.a \ +- $(top_srcdir)/src/libs/zbxbincommon/libzbxbincommon.a \ +- $(top_srcdir)/src/libs/zbxcurl/libzbxcurl.a ++ $(top_builddir)/src/libs/zbxlog/libzbxlog.a \ ++ $(top_builddir)/src/libs/zbxembed/libzbxembed.a \ ++ $(top_builddir)/src/libs/zbxjson/libzbxjson.a \ ++ $(top_builddir)/src/libs/zbxregexp/libzbxregexp.a \ ++ $(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \ ++ $(top_builddir)/src/libs/zbxthreads/libzbxthreads.a \ ++ $(top_builddir)/src/libs/zbxmutexs/libzbxmutexs.a \ ++ $(top_builddir)/src/libs/zbxprof/libzbxprof.a \ ++ $(top_builddir)/src/libs/zbxnix/libzbxnix.a \ ++ $(top_builddir)/src/libs/zbxcomms/libzbxcomms.a \ ++ $(top_builddir)/src/libs/zbxip/libzbxip.a \ ++ $(top_builddir)/src/libs/zbxgetopt/libzbxgetopt.a \ ++ $(top_builddir)/src/libs/zbxhash/libzbxhash.a \ ++ $(top_builddir)/src/libs/zbxcrypto/libzbxcrypto.a \ ++ $(top_builddir)/src/libs/zbxcompress/libzbxcompress.a \ ++ $(top_builddir)/src/libs/zbxhttp/libzbxhttp.a \ ++ $(top_builddir)/src/libs/zbxvariant/libzbxvariant.a \ ++ $(top_builddir)/src/libs/zbxxml/libzbxxml.a \ ++ $(top_builddir)/src/libs/zbxstr/libzbxstr.a \ ++ $(top_builddir)/src/libs/zbxnum/libzbxnum.a \ ++ $(top_builddir)/src/libs/zbxtime/libzbxtime.a \ ++ $(top_builddir)/src/libs/zbxcommon/libzbxcommon.a \ ++ $(top_builddir)/src/libs/zbxbincommon/libzbxbincommon.a \ ++ $(top_builddir)/src/libs/zbxcurl/libzbxcurl.a + + zabbix_js_LDADD += @ZBXJS_LIBS@ $(LIBXML2_LIBS) + +diff --git a/src/zabbix_proxy/Makefile.am b/src/zabbix_proxy/Makefile.am +index b56f8a8..44800a0 100644 +--- a/src/zabbix_proxy/Makefile.am ++++ b/src/zabbix_proxy/Makefile.am +@@ -151,4 +151,4 @@ install-data-hook: + $(MKDIR_P) "$(DESTDIR)$(PROXY_CONFIG_FILE).d" + $(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)" + $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" +- test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "../../conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" ++ test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" +diff --git a/src/zabbix_server/Makefile.am b/src/zabbix_server/Makefile.am +index 0a55934..a7f6a28 100644 +--- a/src/zabbix_server/Makefile.am ++++ b/src/zabbix_server/Makefile.am +@@ -186,4 +186,4 @@ install-data-hook: + $(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)" + $(MKDIR_P) "$(DESTDIR)$(ALERT_SCRIPTS_PATH)" + $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" +- test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "../../conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" ++ test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" +--- zabbix-7.0.3/configure.ac.out-of-tree 2024-08-19 14:38:13.426482392 -0600 ++++ zabbix-7.0.3/configure.ac 2024-08-19 14:40:30.842129965 -0600 +@@ -24,7 +24,7 @@ + + AC_CONFIG_HEADERS(include/common/config.h) + +-AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include']) ++AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include']) + + AC_CANONICAL_HOST + diff --git a/zabbix-php-fpm.conf b/zabbix-php-fpm.conf new file mode 100644 index 0000000..fa38188 --- /dev/null +++ b/zabbix-php-fpm.conf @@ -0,0 +1,24 @@ +[zabbix] +user = apache +group = apache + +listen = /run/php-fpm/zabbix.sock +listen.acl_users = apache,nginx +listen.allowed_clients = 127.0.0.1 + +pm = dynamic +pm.max_children = 50 +pm.start_servers = 5 +pm.min_spare_servers = 5 +pm.max_spare_servers = 35 + +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session + +php_value[max_execution_time] = 300 +php_value[memory_limit] = 128M +php_value[post_max_size] = 16M +php_value[upload_max_filesize] = 2M +php_value[max_input_time] = 300 +php_value[max_input_vars] = 10000 +; php_value[date.timezone] = Europe/Riga diff --git a/zabbix-proxy-mysql.service b/zabbix-proxy-mysql.service new file mode 100644 index 0000000..ac9fad0 --- /dev/null +++ b/zabbix-proxy-mysql.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix MySQL Proxy +After=syslog.target network.target mysqld.service + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_proxy -f +User=zabbixsrv + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-proxy-pgsql.service b/zabbix-proxy-pgsql.service new file mode 100644 index 0000000..f31cbac --- /dev/null +++ b/zabbix-proxy-pgsql.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix PostgreSQL Proxy +After=syslog.target network.target postgresql.service + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_proxy -f +User=zabbixsrv + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-proxy-sqlite3.service b/zabbix-proxy-sqlite3.service new file mode 100644 index 0000000..703d7cd --- /dev/null +++ b/zabbix-proxy-sqlite3.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix SQLite3 Proxy +After=syslog.target network.target + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_proxy -f +User=zabbixsrv + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-server-mysql.service b/zabbix-server-mysql.service new file mode 100644 index 0000000..d8d8a5a --- /dev/null +++ b/zabbix-server-mysql.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix Server with MySQL DB +After=syslog.target network.target mysqld.service + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_server -f +User=zabbixsrv + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-server-pgsql.service b/zabbix-server-pgsql.service new file mode 100644 index 0000000..182b7e1 --- /dev/null +++ b/zabbix-server-pgsql.service @@ -0,0 +1,11 @@ +[Unit] +Description=Zabbix Server with PostgreSQL DB +After=syslog.target network.target postgresql.service + +[Service] +Type=simple +ExecStart=/usr/sbin/zabbix_server -f +User=zabbixsrv + +[Install] +WantedBy=multi-user.target diff --git a/zabbix-tmpfiles-zabbix.conf b/zabbix-tmpfiles-zabbix.conf new file mode 100644 index 0000000..cce12dd --- /dev/null +++ b/zabbix-tmpfiles-zabbix.conf @@ -0,0 +1 @@ +D /run/zabbix 0755 zabbix zabbix - diff --git a/zabbix-tmpfiles-zabbixsrv.conf b/zabbix-tmpfiles-zabbixsrv.conf new file mode 100644 index 0000000..f3f4b90 --- /dev/null +++ b/zabbix-tmpfiles-zabbixsrv.conf @@ -0,0 +1 @@ +D /run/zabbixsrv 0755 zabbixsrv zabbixsrv - diff --git a/zabbix-web.conf b/zabbix-web.conf new file mode 100644 index 0000000..34c38b4 --- /dev/null +++ b/zabbix-web.conf @@ -0,0 +1,35 @@ +# +# Zabbix monitoring system php web frontend +# + +Alias /zabbix /usr/share/zabbix + + + Options FollowSymLinks + AllowOverride None + Require all granted + + + DirectoryIndex index.php + + + + SetHandler "proxy:unix:/run/php-fpm/zabbix.sock|fcgi://localhost" + + + + + Require all denied + + + + Require all denied + + + + Require all denied + + + + Require all denied + diff --git a/zabbix.fc b/zabbix.fc new file mode 100644 index 0000000..a1e3556 --- /dev/null +++ b/zabbix.fc @@ -0,0 +1,25 @@ +/etc/rc\.d/init\.d/(zabbix|zabbix-server) -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) + +/usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_exec_t,s0) + +/usr/sbin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_exec_t,s0) +/usr/sbin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_server_mysql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_server_pgsql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_server_sqlite3 -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_proxy -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_proxy_mysql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_proxy_pgsql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_proxy_sqlite3 -- gen_context(system_u:object_r:zabbix_exec_t,s0) + +/var/lib/zabbix(/.*)? gen_context(system_u:object_r:zabbix_var_lib_t,s0) + +/var/lib/zabbixsrv(/.*)? gen_context(system_u:object_r:zabbix_var_lib_t,s0) +/var/lib/zabbixsrv/.*scripts(/.*)? gen_context(system_u:object_r:zabbix_script_exec_t,s0) +/var/lib/zabbixsrv/tmp(/.*)? gen_context(system_u:object_r:zabbix_tmp_t,s0) + +/var/log/zabbix.* gen_context(system_u:object_r:zabbix_log_t,s0) + +/var/run/zabbix(/.*)? gen_context(system_u:object_r:zabbix_var_run_t,s0) diff --git a/zabbix.if b/zabbix.if new file mode 100644 index 0000000..7cf8202 --- /dev/null +++ b/zabbix.if @@ -0,0 +1,199 @@ +## Distributed infrastructure monitoring + +######################################## +## +## Execute a domain transition to run zabbix. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`zabbix_domtrans',` + gen_require(` + type zabbix_t, zabbix_exec_t; + ') + + domtrans_pattern($1, zabbix_exec_t, zabbix_t) +') + +######################################## +## +## Execute a domain transition to run zabbix_script. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`zabbix_script_domtrans',` + gen_require(` + type zabbix_script_t, zabbix_script_exec_t; + ') + + domtrans_pattern($1, zabbix_script_exec_t, zabbix_script_t) +') + +######################################## +## +## Allow connectivity to the zabbix server +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_sendrecv_zabbix_agent_client_packets($1) + corenet_tcp_connect_zabbix_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) +') + +######################################## +## +## Allow the specified domain to read zabbix's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`zabbix_read_log',` + gen_require(` + type zabbix_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, zabbix_log_t, zabbix_log_t) +') + +######################################## +## +## Allow the specified domain to read zabbix's tmp files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`zabbix_read_tmp',` + gen_require(` + type zabbix_tmp_t; + ') + + files_search_tmp($1) + read_files_pattern($1, zabbix_tmp_t, zabbix_tmp_t) +') + +######################################## +## +## Allow the specified domain to append +## zabbix log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_append_log',` + gen_require(` + type zabbix_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, zabbix_log_t, zabbix_log_t) +') + +######################################## +## +## Read zabbix PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_read_pid_files',` + gen_require(` + type zabbix_var_run_t; + ') + + files_search_pids($1) + allow $1 zabbix_var_run_t:file read_file_perms; +') + +######################################## +## +## Allow connectivity to a zabbix agent +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_agent_tcp_connect',` + gen_require(` + type zabbix_t, zabbix_agent_t; + ') + + corenet_sendrecv_zabbix_agent_client_packets($1) + corenet_tcp_connect_zabbix_agent_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_agent_port($1) +') + +######################################## +## +## All of the rules required to administrate +## an zabbix environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the zabbix domain. +## +## +## +# +interface(`zabbix_admin',` + gen_require(` + type zabbix_t, zabbix_log_t, zabbix_var_run_t; + type zabbix_initrc_exec_t; + ') + + allow $1 zabbix_t:process signal_perms; + ps_process_pattern($1, zabbix_t) + tunable_policy(`deny_ptrace',`',` + allow $1 zabbix_t:process ptrace; + ') + + init_labeled_script_domtrans($1, zabbix_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 zabbix_initrc_exec_t system_r; + allow $2 system_r; + + logging_list_logs($1) + admin_pattern($1, zabbix_log_t) + + files_list_pids($1) + admin_pattern($1, zabbix_var_run_t) +') diff --git a/zabbix.te b/zabbix.te new file mode 100644 index 0000000..4ff1bb7 --- /dev/null +++ b/zabbix.te @@ -0,0 +1,374 @@ +policy_module(zabbix, 1.7.0) + +######################################## +# +# Declarations +# + +## +##

+## Determine whether zabbix can +## connect to all TCP ports +##

+## +gen_tunable(zabbix_can_network, false) + + +## +##

+## Allow Zabbix to run su/sudo. +##

+## +gen_tunable(zabbix_run_sudo, false) + +gen_require(` + class passwd rootok; + class passwd passwd; +') + +attribute zabbix_domain; + +type zabbix_t, zabbix_domain; +type zabbix_exec_t; +init_daemon_domain(zabbix_t, zabbix_exec_t) + +type zabbix_initrc_exec_t; +init_script_file(zabbix_initrc_exec_t) + +type zabbix_agent_t, zabbix_domain; +type zabbix_agent_exec_t; +init_daemon_domain(zabbix_agent_t, zabbix_agent_exec_t) + +type zabbix_agent_initrc_exec_t; +init_script_file(zabbix_agent_initrc_exec_t) + +type zabbixd_var_lib_t; +files_type(zabbixd_var_lib_t) + +type zabbix_log_t; +logging_log_file(zabbix_log_t) + +type zabbix_tmp_t; +files_tmp_file(zabbix_tmp_t) + +type zabbix_tmpfs_t; +files_tmpfs_file(zabbix_tmpfs_t) + +type zabbix_var_lib_t; +files_type(zabbix_var_lib_t) + +type zabbix_var_run_t; +files_pid_file(zabbix_var_run_t) + +type zabbix_script_t; +type zabbix_script_exec_t; +domain_type(zabbix_script_t) +domain_entry_file(zabbix_script_t, zabbix_script_exec_t) +application_executable_file(zabbix_script_exec_t) +role system_r types zabbix_script_t; + +######################################## +# +# zabbix domain local policy +# + +allow zabbix_domain self:capability { setgid setuid }; +allow zabbix_domain self:process { getsched setpgid setsched signal_perms }; +allow zabbix_domain self:fifo_file rw_fifo_file_perms; +allow zabbix_domain self:sem create_sem_perms; +allow zabbix_domain self:shm create_shm_perms; +allow zabbix_domain self:tcp_socket { accept listen }; +allow zabbix_domain self:unix_stream_socket create_stream_socket_perms; + +kernel_read_all_sysctls(zabbix_domain) +kernel_read_network_state(zabbix_domain) + +corenet_tcp_sendrecv_generic_if(zabbix_domain) +corenet_tcp_sendrecv_generic_node(zabbix_domain) +corenet_tcp_bind_generic_node(zabbix_domain) + +corecmd_exec_shell(zabbix_domain) +corecmd_exec_bin(zabbix_domain) + +dev_read_sysfs(zabbix_domain) +dev_read_urand(zabbix_domain) + +######################################## +# +# Local policy +# + +allow zabbix_t self:capability { dac_read_search }; +allow zabbix_t self:process { setrlimit }; +allow zabbix_t self:unix_stream_socket connectto; + +manage_dirs_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t) +manage_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t) +manage_lnk_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t) +manage_sock_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t) +files_var_lib_filetrans(zabbix_t, zabbix_var_lib_t, dir, "zabbixsrv") + +manage_dirs_pattern(zabbix_t, zabbix_log_t, zabbix_log_t) +manage_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t) +manage_lnk_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t) +logging_log_filetrans(zabbix_t, zabbix_log_t, { dir file }) + +manage_dirs_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t) +manage_files_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t) +manage_sock_files_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t) +files_tmp_filetrans(zabbix_t, zabbix_tmp_t, { dir file sock_file }) + +rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, file) + +manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) +manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) +manage_sock_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) +files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file sock_file }) + +kernel_read_system_state(zabbix_t) + +corenet_all_recvfrom_unlabeled(zabbix_t) +corenet_all_recvfrom_netlabel(zabbix_t) + +corenet_sendrecv_ftp_client_packets(zabbix_t) +corenet_tcp_connect_ftp_port(zabbix_t) +corenet_tcp_sendrecv_ftp_port(zabbix_t) + +corenet_sendrecv_http_client_packets(zabbix_t) +corenet_tcp_connect_http_port(zabbix_t) +corenet_tcp_sendrecv_http_port(zabbix_t) +corenet_tcp_connect_smtp_port(zabbix_t) + +corenet_sendrecv_zabbix_server_packets(zabbix_t) +corenet_tcp_bind_zabbix_port(zabbix_t) +corenet_tcp_sendrecv_zabbix_port(zabbix_t) + +auth_use_nsswitch(zabbix_t) + +zabbix_agent_tcp_connect(zabbix_t) + +logging_send_syslog_msg(zabbix_t) + +tunable_policy(`zabbix_can_network',` + corenet_sendrecv_all_client_packets(zabbix_t) + corenet_tcp_connect_all_ports(zabbix_t) + corenet_tcp_sendrecv_all_ports(zabbix_t) +') + +tunable_policy(`zabbix_run_sudo',` + allow zabbix_t self:capability { setgid setuid sys_resource }; + allow zabbix_t self:process { setrlimit setsched }; + allow zabbix_t self:key write; + allow zabbix_t self:passwd { passwd rootok }; + + auth_rw_lastlog(zabbix_t) + auth_rw_faillog(zabbix_t) + auth_exec_chkpwd(zabbix_t) + + selinux_compute_access_vector(zabbix_t) + + systemd_write_inherited_logind_sessions_pipes(zabbix_t) + systemd_dbus_chat_logind(zabbix_t) + + xserver_exec_xauth(zabbix_t) +') + +optional_policy(` + tunable_policy(`zabbix_run_sudo',` + sudo_exec(zabbix_t) + su_exec(zabbix_t) + ') +') + +optional_policy(` + mysql_stream_connect(zabbix_t) +') + +optional_policy(` + netutils_domtrans_ping(zabbix_t) +') + +optional_policy(` + postgresql_stream_connect(zabbix_t) + postgresql_tcp_connect(zabbix_t) +') + +optional_policy(` + snmp_read_snmp_var_lib_files(zabbix_t) + snmp_read_snmp_var_lib_dirs(zabbix_t) +') + +######################################## +# +# Agent local policy +# + +allow zabbix_agent_t self:process { setrlimit }; + +manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) + +rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) + +manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) +files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) + +kernel_read_system_state(zabbix_agent_t) +kernel_read_network_state(zabbix_agent_t) + +corenet_all_recvfrom_unlabeled(zabbix_agent_t) +corenet_all_recvfrom_netlabel(zabbix_agent_t) + +corecmd_read_all_executables(zabbix_agent_t) + +corenet_sendrecv_zabbix_agent_server_packets(zabbix_agent_t) +corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) +corenet_tcp_sendrecv_zabbix_agent_port(zabbix_agent_t) + +corenet_sendrecv_ssh_client_packets(zabbix_agent_t) +corenet_tcp_connect_ssh_port(zabbix_agent_t) +corenet_tcp_sendrecv_ssh_port(zabbix_agent_t) + +corenet_sendrecv_ftp_client_packets(zabbix_agent_t) +corenet_tcp_connect_ftp_port(zabbix_agent_t) +corenet_tcp_sendrecv_ftp_port(zabbix_agent_t) + +corenet_sendrecv_http_client_packets(zabbix_agent_t) +corenet_tcp_connect_http_port(zabbix_agent_t) +corenet_tcp_sendrecv_http_port(zabbix_agent_t) + +corenet_sendrecv_innd_client_packets(zabbix_agent_t) +corenet_tcp_connect_innd_port(zabbix_agent_t) +corenet_tcp_sendrecv_innd_port(zabbix_agent_t) + +corenet_sendrecv_pop_client_packets(zabbix_agent_t) +corenet_tcp_connect_pop_port(zabbix_agent_t) +corenet_tcp_sendrecv_pop_port(zabbix_agent_t) + +corenet_sendrecv_postgresql_client_packets(zabbix_agent_t) +corenet_tcp_connect_postgresql_port(zabbix_agent_t) +corenet_tcp_sendrecv_postgresql_port(zabbix_agent_t) + +corenet_sendrecv_smtp_client_packets(zabbix_agent_t) +corenet_tcp_connect_smtp_port(zabbix_agent_t) +corenet_tcp_sendrecv_smtp_port(zabbix_agent_t) + +corenet_sendrecv_zabbix_client_packets(zabbix_agent_t) +corenet_tcp_connect_zabbix_port(zabbix_agent_t) +corenet_tcp_sendrecv_zabbix_port(zabbix_agent_t) + +corenet_tcp_connect_redis_port(zabbix_agent_t) +corenet_tcp_sendrecv_redis_port(zabbix_agent_t) + +dev_getattr_all_blk_files(zabbix_agent_t) +dev_getattr_all_chr_files(zabbix_agent_t) + +domain_read_all_domains_state(zabbix_agent_t) + +files_getattr_all_dirs(zabbix_agent_t) +files_getattr_all_files(zabbix_agent_t) +files_read_all_symlinks(zabbix_agent_t) + +fs_getattr_all_fs(zabbix_agent_t) + +auth_use_nsswitch(zabbix_agent_t) + +init_read_utmp(zabbix_agent_t) + +logging_search_logs(zabbix_agent_t) + +sysnet_dns_name_resolve(zabbix_agent_t) + +zabbix_tcp_connect(zabbix_agent_t) + +zabbix_script_domtrans(zabbix_agent_t) + +# These are triggered by vfs.dev.discovery enumerating everyting in /dev +gen_require(` + type devlog_t; +') +dontaudit zabbix_agent_t devlog_t:sock_file getattr; +init_dontaudit_getattr_initctl(zabbix_agent_t) +kernel_dontaudit_getattr_core_if(zabbix_agent_t) + +gen_require(` + type kernel_t, sudo_log_t; +') +tunable_policy(`zabbix_run_sudo',` + allow zabbix_agent_t self:capability { chown dac_read_search setgid setuid sys_resource }; + allow zabbix_agent_t self:process { setrlimit setsched }; + allow zabbix_agent_t self:key write; + allow zabbix_agent_t self:passwd { passwd rootok }; + + allow zabbix_agent_t sudo_log_t:dir { add_name create setattr write }; + allow zabbix_agent_t sudo_log_t:file { create open read setattr write }; + + allow zabbix_agent_t devlog_t:sock_file write; + allow zabbix_agent_t kernel_t:unix_dgram_socket sendto; + allow zabbix_agent_t self:unix_dgram_socket { connect create }; + + auth_domtrans_chkpwd(zabbix_agent_t) + auth_rw_lastlog(zabbix_agent_t) + auth_rw_faillog(zabbix_agent_t) + + logging_send_audit_msgs(zabbix_agent_t) + + selinux_compute_access_vector(zabbix_agent_t) + + sssd_read_config(zabbix_agent_t) + + systemd_write_inherited_logind_sessions_pipes(zabbix_agent_t) + systemd_dbus_chat_logind(zabbix_agent_t) + + xserver_exec_xauth(zabbix_agent_t) + + # Conceivably this could be under a separate boolean, but the reason to allow sudo + # is to allow check like this + lvm_domtrans(zabbix_agent_t) +') + +optional_policy(` + rpm_exec(zabbix_agent_t) + rpm_read_db(zabbix_agent_t) +') + +optional_policy(` + tunable_policy(`zabbix_run_sudo',` + sudo_exec(zabbix_agent_t) + su_exec(zabbix_agent_t) + ') +') + +optional_policy(` + dmidecode_domtrans(zabbix_agent_t) +') + +optional_policy(` + hostname_exec(zabbix_agent_t) +') + +######################################## +# +# zabbix_script_t local policy +# + +domtrans_pattern(zabbix_t, zabbix_script_exec_t, zabbix_script_t) + +allow zabbix_t zabbix_script_exec_t:dir list_dir_perms; +allow zabbix_t zabbix_script_exec_t:file ioctl; +allow zabbix_t zabbix_script_t:process signal; + +init_domtrans_script(zabbix_script_t) + +optional_policy(` + chronyd_domtrans_chronyc(zabbix_script_t) +') + +optional_policy(` + mta_send_mail(zabbix_script_t) +') + +optional_policy(` + unconfined_domain(zabbix_script_t) +') diff --git a/zabbix7.0.spec b/zabbix7.0.spec new file mode 100644 index 0000000..4423e54 --- /dev/null +++ b/zabbix7.0.spec @@ -0,0 +1,876 @@ +# TODO, maybe sometime: +# * Allow for nginx? +# * Consider using systemd's ReadWriteDirectories + +#TODO: systemctl reload seems to be necessary after switching with Alternatives +#TODO: If the DB path for a Sqlite proxy is configured wrong, it requires systemctl restart. Start doesn't work. + +%global srcname zabbix +%global with_selinux 1 +%global selinuxtype targeted +# go is needed for agent2, but there are missing deps +%bcond_with go +# Missing dependencies for the java connector +%bcond_with java + +%global majver 7.0 + +Name: zabbix%{majver} +Version: %{majver}.3 +Release: 1%{?dist} +Summary: Open-source monitoring solution for your IT infrastructure + +# TODO - Note additional licenses in src/go when we start building with go +# src/libs/zbxembed/duktape.c: MIT License +# src/libs/zbxembed/duktape.h: MIT License +# src/libs/zbxgetopt/getopt.c: GNU General Public License v2.0 or later +# src/libs/zbxhash/md5.c: zlib License +# ui/vendor/composer/LICENSE: MIT License +# ui/js/vendors/D3/LICENSE: ISC License +# ui/js/vendors/Leaflet/LICENSE: BSD 2-Clause License +# ui/js/vendors/Leaflet.markercluster/LICENSE: MIT License +# ui/js/vendors/jQueryUI/LICENSE: MIT License +# ui/js/vendors/qrcode/LICENSE: MIT License +# ui/vendor/duosecurity/duo_universal_php/LICENSE: BSD 3-Clause License +# ui/vendor/firebase/php-jwt/LICENSE: BSD 3-Clause License +# ui/vendor/onelogin/php-saml/LICENSE: MIT License +# ui/vendor/paragonie/constant_time_encoding/LICENSE.txt: MIT License +# ui/vendor/pragmarx/google2fa/LICENSE.md: MIT License +# ui/vendor/symfony/deprecation-contracts/LICENSE: MIT License +# ui/vendor/symfony/polyfill-ctype/LICENSE: MIT License +# ui/vendor/symfony/yaml/LICENSE: MIT License +# ui/assets/styles/vendors/Leaflet/LICENSE: BSD 2-Clause License +# ui/vendor/paragonie/constant_time_encoding/src/*.php: MIT License +License: AGPL-3.0-only AND MIT AND GPL-2.0-or-later AND Zlib AND BSD-3-Clause AND BSD-2-Clause AND ISC +URL: https://www.zabbix.com +Source0: https://cdn.zabbix.com/zabbix/sources/stable/%{majver}/zabbix-%{version}.tar.gz +Source1: %{srcname}-web.conf +Source2: %{srcname}-php-fpm.conf +Source5: %{srcname}-logrotate.in +Source9: %{srcname}-tmpfiles-zabbix.conf +# systemd units -- Alternatives switches between them (they state their dependencies) +# https://support.zabbix.com/browse/ZBXNEXT-1593 +Source10: %{srcname}-agent.service +Source11: %{srcname}-proxy-mysql.service +Source12: %{srcname}-proxy-pgsql.service +Source13: %{srcname}-proxy-sqlite3.service +Source14: %{srcname}-server-mysql.service +Source15: %{srcname}-server-pgsql.service +Source16: %{srcname}-fedora-epel.README +Source17: %{srcname}-tmpfiles-zabbixsrv.conf +Source18: %{srcname}.te +Source19: %{srcname}.if +Source20: %{srcname}.fc + +# This is not a symlink, because we don't want the webserver to possibly ever serve it. +# local rules for config files +Patch0: %{srcname}-config.patch +# Allow out-of-tree builds +# https://support.zabbix.com/browse/ZBXNEXT-6077 +Patch1: %{srcname}-out-of-tree.patch +# Enforce Fedora Crypto Policy +Patch2: %{srcname}-crypto-policy.patch +# Add to sscanf check +# https://support.zabbix.com/browse/ZBX-21946 +Patch3: %{srcname}-configure-sscanf.patch + +# Patch1 patches automake files so we need to autoreconf +BuildRequires: libtool +BuildRequires: make +BuildRequires: mariadb-connector-c-devel +BuildRequires: libpq-devel +BuildRequires: sqlite-devel +BuildRequires: net-snmp-devel +BuildRequires: openldap-devel +BuildRequires: openssl-devel +BuildRequires: gnutls-devel +BuildRequires: unixODBC-devel +BuildRequires: curl-devel +BuildRequires: OpenIPMI-devel +BuildRequires: libssh2-devel +BuildRequires: libxml2-devel +BuildRequires: libevent-devel +BuildRequires: pcre2-devel +BuildRequires: gcc +# For Agent 2 - has missing deps +%if %{with go} +BuildRequires: gcc-go +#BuildRequires: golang(github.com/alimy/mc/v2) +BuildRequires: golang(github.com/docker/go-connections) +#BuildRequires: golang(github.com/dustin/gomemcached) +BuildRequires: golang(github.com/fsnotify/fsnotify) +BuildRequires: golang(github.com/go-ldap/ldap) +#BuildRequires: golang(github.com/go-ole/go-ole) +BuildRequires: golang(github.com/go-sql-driver/mysql) +BuildRequires: golang(github.com/godbus/dbus) +#BuildRequires: golang(github.com/jackc/pgx/v4) +BuildRequires: golang(github.com/mattn/go-sqlite3) +#BuildRequires: golang(github.com/mediocregopher/radix/v3) +#BuildRequires: golang(github.com/natefinch/npipe) +#BuildRequires: golang(github.com/testcontainers/testcontainers-go) +#BuildRequires: golang(golang.org/x/sys) +%endif +BuildRequires: systemd +# Needed to determine path to link to +BuildRequires: dejavu-sans-fonts + +Requires: logrotate + +%if 0%{?with_selinux} +# This ensures that the *-selinux package and all it’s dependencies are not pulled +# into containers and other systems that do not use SELinux +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%endif + +Provides: bundled(md5-deutsch) +# Could alternatively be conditional on Fedora/EL +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname} = %{version}-%{release} +Conflicts: %{srcname} < %{majver} +%endif + +%description +Zabbix is software that monitors numerous parameters of a network and the +health and integrity of servers. Zabbix uses a flexible notification mechanism +that allows users to configure e-mail based alerts for virtually any event. +This allows a fast reaction to server problems. Zabbix offers excellent +reporting and data visualization features based on the stored data. +This makes Zabbix ideal for capacity planning. + +Zabbix supports both polling and trapping. All Zabbix reports and statistics, +as well as configuration parameters are accessed through a web-based front end. +A web-based front end ensures that the status of your network and the health of +your servers can be assessed from any location. Properly configured, Zabbix can +play an important role in monitoring IT infrastructure. This is equally true +for small organizations with a few servers and for large companies with a +multitude of servers. + +%package dbfiles-mysql +Summary: Zabbix database schemas, images, data and patches +BuildArch: noarch +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-dbfiles-mysql = %{version}-%{release} +Conflicts: %{srcname}-dbfiles-mysql < %{majver} +%endif + +%description dbfiles-mysql +Zabbix database schemas, images, data and patches necessary for creating +and/or updating MySQL databases + +%package dbfiles-pgsql +Summary: Zabbix database schemas, images, data and patches +BuildArch: noarch +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-dbfiles-pgsql = %{version}-%{release} +Conflicts: %{srcname}-dbfiles-pgsql < %{majver} +%endif + +%description dbfiles-pgsql +Zabbix database schemas, images, data and patches necessary for creating +and/or updating PostgreSQL databases + +%package dbfiles-sqlite3 +Summary: Zabbix database schemas and patches +BuildArch: noarch +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-dbfiles-sqlite3 = %{version}-%{release} +Conflicts: %{srcname}-dbfiles-sqlite3 < %{majver} +%endif + +%description dbfiles-sqlite3 +Zabbix database schemas and patches necessary for creating +and/or updating SQLite databases + +%package server +Summary: Zabbix server common files +BuildArch: noarch +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: fping +Requires: traceroute +Requires(pre): shadow-utils +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-server = %{version}-%{release} +Conflicts: %{srcname}-server < %{majver} +%endif + +%description server +Zabbix server common files + +%package server-mysql +Summary: Zabbix server compiled to use MySQL +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-dbfiles-mysql +Requires: %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(posttrans): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +Provides: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-server-mysql = %{version}-%{release} +Conflicts: %{srcname}-server-mysql < %{majver} +%endif + +%description server-mysql +Zabbix server compiled to use MySQL + +%package server-pgsql +Summary: Zabbix server compiled to use PostgreSQL +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-dbfiles-pgsql +Requires(posttrans): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +Provides: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-server-pgsql = %{version}-%{release} +Conflicts: %{srcname}-server-pgsql < %{majver} +%endif + +%description server-pgsql +Zabbix server compiled to use PostgreSQL + +%package agent +Summary: Zabbix agent +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(pre): shadow-utils +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-agent = %{version}-%{release} +Conflicts: %{srcname}-agent < %{majver} +%endif + +%description agent +Zabbix agent, to be installed on monitored systems + +%package proxy +Summary: Zabbix proxy common files +BuildArch: noarch +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(pre): shadow-utils +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +Requires: fping +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-proxy = %{version}-%{release} +Conflicts: %{srcname}-proxy < %{majver} +%endif + +%description proxy +Zabbix proxy commmon files + +%package proxy-mysql +Summary: Zabbix proxy compiled to use MySQL +Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-dbfiles-mysql +Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(posttrans): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-proxy-mysql = %{version}-%{release} +Conflicts: %{srcname}-proxy-mysql < %{majver} +%endif + +%description proxy-mysql +Zabbix proxy compiled to use MySQL + +%package proxy-pgsql +Summary: Zabbix proxy compiled to use PostgreSQL +Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-dbfiles-pgsql +Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(posttrans): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-proxy-pgsql = %{version}-%{release} +Conflicts: %{srcname}-proxy-pgsql < %{majver} +%endif + +%description proxy-pgsql +Zabbix proxy compiled to use PostgreSQL + +%package proxy-sqlite3 +Summary: Zabbix proxy compiled to use SQLite +Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-dbfiles-sqlite3 +Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(posttrans): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-proxy-sqlite3 = %{version}-%{release} +Conflicts: %{srcname}-proxy-sqlite3 < %{majver} +%endif + +%description proxy-sqlite3 +Zabbix proxy compiled to use SQLite + +%package web +Summary: Zabbix Web Frontend +BuildArch: noarch +Requires: php-bcmath +Requires: php-fpm +Requires: php-gd +Requires: php-gettext +Requires: php-json +Requires: php-ldap +Requires: php-mbstring +Requires: php-xml +# jquery 3.6.0 and jquery-ui 1.13.2 in the sources +Requires: js-jquery >= 3.6.0 +Provides: bundled(js-jquery-ui) = 1.13.2 +# prototype 1.6.1 in the sources, Fedora package is dead +#Requires: prototype +Requires: dejavu-sans-fonts +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-web = %{version}-%{release} +Conflicts: %{srcname}-web < %{majver} +%endif + +%description web +The php frontend to display the Zabbix web interface. + +%package web-mysql +Summary: Zabbix web frontend for MySQL +BuildArch: noarch +Requires: %{name}-web = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: php-mysqli +Provides: %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-web-mysql = %{version}-%{release} +Conflicts: %{srcname}-web-mysql < %{majver} +%endif + +%description web-mysql +Zabbix web frontend for MySQL + +%package web-pgsql +Summary: Zabbix web frontend for PostgreSQL +BuildArch: noarch +Requires: %{name}-web = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: php-pgsql +Provides: %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-web-pgsql = %{version}-%{release} +Conflicts: %{srcname}-web-pgsql < %{majver} +%endif + +%description web-pgsql +Zabbix web frontend for PostgreSQL + +%if %{with java} +%package -n java-%{srcname} +Summary: Zabbix Java connector +BuildArch: noarch +BuildRequires: java-devel +BuildRequires: osgi(org.junit) +BuildRequires: osgi(slf4j.api) +BuildRequires: osgi(logback) +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-java = %{version}-%{release} +Conflicts: %{srcname}-java < %{majver} +%endif + +%description -n java-%{srcname} +Zabbix Java connector. +%endif + +%if 0%{?with_selinux} +# SELinux subpackage +%package selinux +Summary: Zabbix SELinux policy +BuildArch: noarch +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: selinux-policy-devel +%{?selinux_requires} +%if "x%{?srcname}" != "x%{name}" +Provides: %{srcname}-selinux = %{version}-%{release} +Conflicts: %{srcname}-selinux < %{majver} +%endif + +%description selinux +Custom SELinux policy module +%endif + + +%prep +%autosetup -p1 -n %{srcname}-%{version} +autoreconf + +# Remove bundled java libs +find -name \*.jar -delete + +# Remove prebuilt Windows binaries +rm -rf bin + +# Override creation of statically named directory for alertscripts and externalscripts +# https://support.zabbix.com/browse/ZBX-6159 +sed -i '/CURL_SSL_.*_LOCATION\|SCRIPTS_PATH/s|\${datadir}/zabbix|/var/lib/zabbixsrv|' \ + configure + +# Kill off .htaccess files, options set in SOURCE1 +find -name .htaccess -delete + +# Fix path to traceroute utility (on all Linux targets) +find database -name 'data.sql' -exec sed -i 's|/usr/bin/traceroute|/bin/traceroute|' {} \; + +# Common +# Settings with hard-coded defaults that are not suitable for Fedora +# are explicitly set, leaving the comment with the default value in place. +# Settings without hard-coded defaults are simply replaced -- be they +# comments or explicit settings! + +# Also replace the datadir placeholder that is not expanded, but effective +sed -i \ + -e '\|^# LogFileSize=.*|a LogFileSize=0' \ + -e 's|^DBUser=root|DBUser=zabbix|' \ + -e 's|^# DBSocket=.*|DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \ + -e '\|^# ExternalScripts=|a ExternalScripts=%{_sharedstatedir}/zabbixsrv/externalscripts' \ + -e '\|^# AlertScriptsPath=|a AlertScriptsPath=%{_sharedstatedir}/zabbixsrv/alertscripts' \ + -e '\|^# TmpDir=\/tmp|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \ + -e 's|/usr/local||' \ + -e 's|\${datadir}|/usr/share|' \ + conf/zabbix_agentd.conf conf/zabbix_proxy.conf conf/zabbix_server.conf + +# Specific +sed -i \ + -e '\|^# PidFile=.*|a PidFile=%{_rundir}/zabbix/zabbix_agentd.pid' \ + -e 's|^LogFile=.*|LogFile=%{_localstatedir}/log/zabbix/zabbix_agentd.log|' \ + conf/zabbix_agentd.conf + +sed -i \ + -e '\|^# PidFile=.*|a PidFile=%{_rundir}/zabbixsrv/zabbix_proxy.pid' \ + -e 's|^LogFile=.*|LogFile=%{_localstatedir}/log/zabbixsrv/zabbix_proxy.log|' \ + conf/zabbix_proxy.conf + +sed -i \ + -e '\|^# PidFile=.*|a PidFile=%{_rundir}/zabbixsrv/zabbix_server.pid' \ + -e 's|^LogFile=.*|LogFile=%{_localstatedir}/log/zabbixsrv/zabbix_server.log|' \ + conf/zabbix_server.conf + +# Install README file +install -m 0644 -p %{SOURCE16} . + + +%build + +common_flags=" + --enable-dependency-tracking + --enable-proxy + --enable-ipv6 + --with-net-snmp + --with-ldap + --with-libcurl + --with-openipmi + --with-unixodbc + --with-ssh2 + --with-libxml2 + --with-libevent + --with-libpcre2 + --with-openssl +" +# Setup out of tree builds +%global _configure ../configure + +%if %{with java} +export CLASSPATH=$(build-classpath junit slf4j-api logback-core logback-classic android-json) +%endif + +# Frontend doesn't work for SQLite, thus don't build server +mkdir -p build-frontend +cd build-frontend +%configure $common_flags --enable-agent --with-sqlite3 %{?with_go:--enable-agent2} %{?with_java:--enable-java} +%make_build +cd - + +mkdir -p build-server-mysql +cd build-server-mysql +%configure $common_flags --with-mysql --enable-server +%make_build +cd - + +mkdir -p build-server-postgresql +cd build-server-postgresql +%configure $common_flags --with-postgresql --enable-server +%make_build +cd - + +%if 0%{?with_selinux} +# SELinux policy (originally from selinux-policy-contrib) +# this policy module will override the production module +mkdir selinux +cp -p %{SOURCE18} selinux/ +cp -p %{SOURCE19} selinux/ +cp -p %{SOURCE20} selinux/ + +make -f %{_datadir}/selinux/devel/Makefile %{srcname}.pp +bzip2 -9 %{srcname}.pp +%endif + + +%install +# Install binaries +%make_install -C build-frontend +mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_sqlite3} +%make_install -C build-server-mysql +mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_mysql} +mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_server{,_mysql} +%make_install -C build-server-postgresql +mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_pgsql} +mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_server{,_pgsql} + +# Ghosted alternatives +touch $RPM_BUILD_ROOT%{_sbindir}/zabbix_{proxy,server} + +# Home directory for the agent; +# The other home directory is created during installation +mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbix + +# Log directories +mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/zabbix +mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/zabbixsrv + +# systemd tmpfiles +mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d +install -m 0644 -p %{SOURCE9} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/zabbix.conf +install -m 0644 -p %{SOURCE17} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/zabbixsrv.conf +mkdir -p $RPM_BUILD_ROOT%{_rundir} +install -d -m 0755 $RPM_BUILD_ROOT%{_rundir}/zabbix/ +install -d -m 0755 $RPM_BUILD_ROOT%{_rundir}/zabbixsrv/ + +# Install the frontend after removing backup files from patching +find ui -name '*.orig' -delete +mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{srcname} +cp -a ui/* $RPM_BUILD_ROOT%{_datadir}/%{srcname}/ + +# Prepare ghosted config file +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web +touch $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web/zabbix.conf.php + +# Replace bundled font +[ -d %{_fontbasedir}/dejavu ] && + ln -sf ../../../fonts/dejavu/DejaVuSans.ttf $RPM_BUILD_ROOT%{_datadir}/%{srcname}/assets/fonts/ +[ -d %{_fontbasedir}/dejavu-sans-fonts ] && + ln -sf ../../../fonts/dejavu-sans-fonts/DejaVuSans.ttf $RPM_BUILD_ROOT%{_datadir}/%{srcname}/assets/fonts/ + +# Replace JS libraries +# There is no jquery-ui package yet +ln -sf ../../../javascript/jquery/3/jquery.min.js $RPM_BUILD_ROOT%{_datadir}/%{srcname}/js/vendors/jquery.js +#ln -sf ../../../javascript/jquery-ui/1/jquery-ui.min.js $RPM_BUILD_ROOT%{_datadir}/%{srcname}/js/vendors/jquery-ui.js + +# This file is used to switch the frontend to maintenance mode +mv $RPM_BUILD_ROOT%{_datadir}/%{srcname}/conf/maintenance.inc.php $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web/maintenance.inc.php || : + +# Drop Apache config file in place +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d +install -m 0644 -p %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/%{srcname}.conf + +# Drop php-fpm config file in place +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d +install -m 0644 -p %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/%{srcname}.conf + +# Install log rotation +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d +sed -e 's|COMPONENT|agentd|g; s|USER|zabbix|g' %{SOURCE5} > \ + $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-agent +sed -e 's|COMPONENT|server|g; s|USER|zabbixsrv|g' %{SOURCE5} > \ + $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-server +sed -e 's|COMPONENT|proxy|g; s|USER|zabbixsrv|g' %{SOURCE5} > \ + $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-proxy + +# Install different systemd units because of the requirements for DBMS daemons +mkdir -p $RPM_BUILD_ROOT%{_unitdir} +install -m 0644 -p %{SOURCE10} $RPM_BUILD_ROOT%{_unitdir}/zabbix-agent.service +install -m 0644 -p %{SOURCE11} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-mysql.service +install -m 0644 -p %{SOURCE12} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-pgsql.service +install -m 0644 -p %{SOURCE13} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-sqlite3.service +install -m 0644 -p %{SOURCE14} $RPM_BUILD_ROOT%{_unitdir}/zabbix-server-mysql.service +install -m 0644 -p %{SOURCE15} $RPM_BUILD_ROOT%{_unitdir}/zabbix-server-pgsql.service + +# Ghosted alternatives +touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-server.service +touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy.service + +# Directory for fping spooling files +mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbixsrv/tmp + +# Install sql files +for db in postgresql mysql; do + mkdir $RPM_BUILD_ROOT%{_datadir}/%{srcname}-$db + cp -p database/$db/*.sql $RPM_BUILD_ROOT%{_datadir}/%{srcname}-$db +done + +install -dm 755 $RPM_BUILD_ROOT%{_datadir}/%{srcname}-sqlite3 +cp -p database/sqlite3/schema.sql $RPM_BUILD_ROOT%{_datadir}/%{srcname}-sqlite3 + +%if 0%{?with_selinux} +install -D -m 0644 %{srcname}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2 +install -D -p -m 0644 selinux/%{srcname}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{srcname}.if +%endif + + +%post server +%systemd_post zabbix-server.service + +if [ $1 -gt 1 ] ; then + # Apply permissions also in *.rpmnew upgrades from old permissive ones + chmod 0640 %{_sysconfdir}/zabbix_server.conf + chown root:zabbixsrv %{_sysconfdir}/zabbix_server.conf +fi +: + +%posttrans server-mysql +%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ + %{srcname}-server %{_sbindir}/%{srcname}_server_mysql 10 \ + --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ + %{_unitdir}/zabbix-server-mysql.service + +%posttrans server-pgsql +%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ + %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql 10 \ + --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ + %{_unitdir}/zabbix-server-pgsql.service + +%post proxy +%systemd_post zabbix-proxy.service + +if [ $1 -gt 1 ] ; then + # Apply permissions also in *.rpmnew upgrades from old permissive ones + chmod 0640 %{_sysconfdir}/zabbix_proxy.conf + chown root:zabbixsrv %{_sysconfdir}/zabbix_proxy.conf +fi +: + +%posttrans proxy-mysql +%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ + %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql 10 \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + %{_unitdir}/zabbix-proxy-mysql.service + +%posttrans proxy-pgsql +%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ + %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql 10 \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + %{_unitdir}/zabbix-proxy-pgsql.service + +%posttrans proxy-sqlite3 +%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ + %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 10 \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + %{_unitdir}/zabbix-proxy-sqlite3.service + +%if 0%{?with_selinux} +# SELinux contexts are saved so that only affected files can be +# relabeled after the policy module installation +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2 + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} +fi + +%posttrans selinux +%selinux_relabel_post -s %{selinuxtype} +%endif + +%pre agent +getent group zabbix > /dev/null || groupadd -r zabbix +getent passwd zabbix > /dev/null || \ + useradd -r -g zabbix -d %{_sharedstatedir}/zabbix -s /sbin/nologin \ + -c "Zabbix Monitoring System" zabbix +: + +%post agent +%systemd_post zabbix-agent.service + +%pre server +getent group zabbixsrv > /dev/null || groupadd -r zabbixsrv +# The zabbixsrv group is introduced by 2.2 packaging +# The zabbixsrv user was a member of the zabbix group in 2.0 +if getent passwd zabbixsrv > /dev/null; then + if [[ $(id -gn zabbixsrv) == "zabbix" ]]; then + usermod -c "Zabbix Monitoring System -- Proxy or server" -g zabbixsrv zabbixsrv + fi +else + useradd -r -g zabbixsrv -d %{_sharedstatedir}/zabbixsrv -s /sbin/nologin \ + -c "Zabbix Monitoring System -- Proxy or server" zabbixsrv +fi +: + +%preun server + %systemd_preun zabbix-server.service + +%pre proxy +getent group zabbixsrv > /dev/null || groupadd -r zabbixsrv +# The zabbixsrv group is introduced by 2.2 packaging +# The zabbixsrv user was a member of the zabbix group in 2.0 +if getent passwd zabbixsrv > /dev/null; then + if [[ $(id -gn zabbixsrv) == "zabbix" ]]; then + usermod -c "Zabbix Monitoring System -- Proxy or server" -g zabbixsrv zabbixsrv + fi +else + useradd -r -g zabbixsrv -d %{_sharedstatedir}/zabbixsrv -s /sbin/nologin \ + -c "Zabbix Monitoring System -- Proxy or server" zabbixsrv +fi +: + +%preun proxy +%systemd_preun zabbix-proxy.service + +%preun agent +%systemd_preun zabbix-agent.service + +%postun server +%systemd_postun_with_restart zabbix-server.service + +%postun server-mysql +if [ $1 -eq 0 ] ; then + %{_sbindir}/update-alternatives --remove %{srcname}-server %{_sbindir}/%{srcname}_server_mysql +fi + +%postun server-pgsql +if [ $1 -eq 0 ] ; then + %{_sbindir}/update-alternatives --remove %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql +fi + +%postun proxy +%systemd_postun_with_restart zabbix-proxy.service + +%postun proxy-mysql +if [ $1 -eq 0 ] ; then + %{_sbindir}/update-alternatives --remove %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql +fi + +%postun proxy-pgsql +if [ $1 -eq 0 ] ; then + %{_sbindir}/update-alternatives --remove %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql +fi + +%postun proxy-sqlite3 +if [ $1 -eq 0 ] ; then + %{_sbindir}/update-alternatives --remove %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 +fi + +%postun agent +%systemd_postun_with_restart zabbix-agent.service + + +%files +%license COPYING +%doc AUTHORS ChangeLog NEWS README zabbix-fedora-epel.README +%dir %{_sysconfdir}/%{srcname} +%config(noreplace) %{_sysconfdir}/zabbix_agentd.conf +%{_bindir}/zabbix_get +%{_bindir}/zabbix_js +%{_bindir}/zabbix_sender +%{_mandir}/man1/zabbix_get.1* +%{_mandir}/man1/zabbix_sender.1* + +%files dbfiles-mysql +%license COPYING +%{_datadir}/%{srcname}-mysql/ + +%files dbfiles-pgsql +%license COPYING +%{_datadir}/%{srcname}-postgresql/ + +%files dbfiles-sqlite3 +%license COPYING +%{_datadir}/%{srcname}-sqlite3/ + +%files server +%doc misc/snmptrap/zabbix_trap_receiver.pl +%attr(0755,zabbixsrv,zabbixsrv) %dir %{_rundir}/zabbixsrv/ +%{_prefix}/lib/tmpfiles.d/zabbixsrv.conf +%attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_server.conf +%attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv +%config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-server +%ghost %{_sbindir}/zabbix_server +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/tmp +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/alertscripts +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/externalscripts +%ghost %{_unitdir}/zabbix-server.service +%{_mandir}/man8/zabbix_server.8* + +%files server-mysql +%{_sbindir}/zabbix_server_mysql +%{_unitdir}/zabbix-server-mysql.service + +%files server-pgsql +%{_sbindir}/zabbix_server_pgsql +%{_unitdir}/zabbix-server-pgsql.service + +%if 0%{?with_selinux} +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.* +%{_datadir}/selinux/devel/include/distributed/%{srcname}.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%endif + +%files agent +%doc conf/zabbix_agentd/*.conf +%attr(0755,zabbix,zabbix) %dir %{_rundir}/zabbix/ +%{_prefix}/lib/tmpfiles.d/zabbix.conf +%attr(0775,root,zabbix) %dir %{_localstatedir}/log/zabbix +%config(noreplace) %{_sysconfdir}/zabbix_agentd.conf +%config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-agent +%attr(750,zabbix,zabbix) %dir %{_sharedstatedir}/zabbix +%{_unitdir}/zabbix-agent.service +%{_sbindir}/zabbix_agentd +%{_mandir}/man8/zabbix_agentd.8* + +%files proxy +%doc misc/snmptrap/zabbix_trap_receiver.pl +%attr(0755,zabbixsrv,zabbixsrv) %dir %{_rundir}/zabbixsrv/ +%{_prefix}/lib/tmpfiles.d/zabbixsrv.conf +%attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_proxy.conf +%attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv +%config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-proxy +%ghost %{_sbindir}/zabbix_proxy +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/tmp +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/alertscripts +%attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv/externalscripts +%ghost %{_unitdir}/zabbix-proxy.service +%{_mandir}/man8/zabbix_proxy.8* + +%files proxy-mysql +%{_sbindir}/zabbix_proxy_mysql +%{_unitdir}/zabbix-proxy-mysql.service + +%files proxy-pgsql +%{_sbindir}/zabbix_proxy_pgsql +%{_unitdir}/zabbix-proxy-pgsql.service + +%files proxy-sqlite3 +%{_sbindir}/zabbix_proxy_sqlite3 +%{_unitdir}/zabbix-proxy-sqlite3.service + +%files web +%dir %attr(0750,apache,apache) %{_sysconfdir}/%{srcname}/web +%ghost %attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/zabbix.conf.php +%attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/maintenance.inc.php +%config(noreplace) %{_sysconfdir}/httpd/conf.d/zabbix.conf +%config(noreplace) %{_sysconfdir}/php-fpm.d/zabbix.conf +%{_datadir}/%{srcname}/ + +%files web-mysql + +%files web-pgsql + +%changelog +* Tue Sep 03 2024 Orion Poplawski - 7.0.3-1 +- Build for EPEL From 485a34a6117f53f069d281cd7ae96974e4a4bf8e Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Sun, 6 Oct 2024 19:56:53 -0600 Subject: [PATCH 02/16] Update to 7.0.4 - Fix crypto-policy patch that broke SSL connections --- .gitignore | 1 + sources | 2 +- zabbix-crypto-policy.patch | 18 +++++++++--------- zabbix7.0.spec | 6 +++++- 4 files changed, 16 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index d3bfa98..5470cd2 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /zabbix-7.0.3.tar.gz +/zabbix-7.0.4.tar.gz diff --git a/sources b/sources index de4962e..d8c6cb8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.3.tar.gz) = 22149415712017c2fb504972c9673623ea710842611644a934a9f555685a73e516ecbad566048b5ec05ba6404000687feee0815e7b2c8a04fb8fd154c9539671 +SHA512 (zabbix-7.0.4.tar.gz) = 4c4b05d2371a2e78c0b419e467ecb261911096b3603b52aab296aa40ab86cdb4e7006703c9aa5a63f0cfee93bc5320c402b083b45497cdd5d804ed7e774f291e diff --git a/zabbix-crypto-policy.patch b/zabbix-crypto-policy.patch index cf06a65..4f9f49a 100644 --- a/zabbix-crypto-policy.patch +++ b/zabbix-crypto-policy.patch @@ -1,16 +1,16 @@ diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go -index be8cf4a..e68b435 100644 +index b7ddff4..063eb02 100644 --- a/src/go/pkg/tls/tls.go +++ b/src/go/pkg/tls/tls.go -@@ -393,7 +393,7 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch - goto out; +@@ -406,6 +406,8 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch #endif + if (NULL != cipher) + ciphers = cipher; ++ else ++ ciphers = "PROFILE=SYSTEM"; -- if (1 != SSL_CTX_set_cipher_list(ctx, ciphers)) -+ if (1 != SSL_CTX_set_cipher_list(ctx, "PROFILES=SYSTEM")) + if (1 != SSL_CTX_set_cipher_list(ctx, ciphers)) goto out; - - ret = 0; diff --git a/src/libs/zbxcomms/tls_openssl.c b/src/libs/zbxcomms/tls_openssl.c index 40394a3..b2eb0f0 100644 --- a/src/libs/zbxcomms/tls_openssl.c @@ -29,7 +29,7 @@ index 40394a3..b2eb0f0 100644 } } - else if (1 != SSL_CTX_set_cipher_list(ctx_psk, ciphers)) -+ else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILES=SYSTEM")) ++ else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILE=SYSTEM")) { zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of PSK ciphersuites:"); goto out; @@ -38,7 +38,7 @@ index 40394a3..b2eb0f0 100644 } } - else if (1 != SSL_CTX_set_cipher_list(ctx_all, ciphers)) -+ else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILES=SYSTEM")) ++ else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILE=SYSTEM")) { zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of all ciphersuites:"); goto out; diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 4423e54..b8c19c5 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: %{majver}.3 +Version: 7.0.4 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -872,5 +872,9 @@ fi %files web-pgsql %changelog +* Mon Oct 07 2024 Orion Poplawski - 7.0.4-1 +- Update to 7.0.4 +- Fix crypto-policy patch that broke SSL connections + * Tue Sep 03 2024 Orion Poplawski - 7.0.3-1 - Build for EPEL From ffbd39d8d183c7ca50464a8743c1a55c67f0eee6 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 20 Dec 2024 22:00:41 -0700 Subject: [PATCH 03/16] Update to 7.0.7 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 5470cd2..0a6766c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /zabbix-7.0.3.tar.gz /zabbix-7.0.4.tar.gz +/zabbix-7.0.7.tar.gz diff --git a/sources b/sources index d8c6cb8..866fcff 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.4.tar.gz) = 4c4b05d2371a2e78c0b419e467ecb261911096b3603b52aab296aa40ab86cdb4e7006703c9aa5a63f0cfee93bc5320c402b083b45497cdd5d804ed7e774f291e +SHA512 (zabbix-7.0.7.tar.gz) = 670144e89554251a4e45e358fef2185d90bb610b318f637e6f9113685a983c574224d1a39e0b2a521d489a40a185712bad0c4809e39a61cbaa20477255244373 diff --git a/zabbix7.0.spec b/zabbix7.0.spec index b8c19c5..a160417 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.4 +Version: 7.0.7 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -872,6 +872,9 @@ fi %files web-pgsql %changelog +* Sat Dec 21 2024 Orion Poplawski - 7.0.7-1 +- Update to 7.0.7 + * Mon Oct 07 2024 Orion Poplawski - 7.0.4-1 - Update to 7.0.4 - Fix crypto-policy patch that broke SSL connections From 0af1c7fa7329f8457c4200f1ed4418b1c3a07cbc Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 29 Jan 2025 08:26:34 -0700 Subject: [PATCH 04/16] Require php-fpm >= 8.0 --- zabbix7.0.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zabbix7.0.spec b/zabbix7.0.spec index a160417..789a98a 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -314,7 +314,7 @@ Zabbix proxy compiled to use SQLite Summary: Zabbix Web Frontend BuildArch: noarch Requires: php-bcmath -Requires: php-fpm +Requires: php-fpm >= 8.0 Requires: php-gd Requires: php-gettext Requires: php-json From 324a71c1d20e957bfc28a6a1c3dfa0af5daa91a5 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Tue, 18 Feb 2025 09:36:33 -0700 Subject: [PATCH 05/16] Update to 7.0.9 --- .gitignore | 1 + sources | 2 +- zabbix-out-of-tree.patch | 47 +++++++++++++++++++++------------------- zabbix7.0.spec | 5 ++++- 4 files changed, 31 insertions(+), 24 deletions(-) diff --git a/.gitignore b/.gitignore index 0a6766c..ba6e998 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /zabbix-7.0.3.tar.gz /zabbix-7.0.4.tar.gz /zabbix-7.0.7.tar.gz +/zabbix-7.0.9.tar.gz diff --git a/sources b/sources index 866fcff..adfc58a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.7.tar.gz) = 670144e89554251a4e45e358fef2185d90bb610b318f637e6f9113685a983c574224d1a39e0b2a521d489a40a185712bad0c4809e39a61cbaa20477255244373 +SHA512 (zabbix-7.0.9.tar.gz) = 7ff18b69b93fa6d06e1ee8494084b4054f059dfd16c2af776f9347c6e14ad16ce61e328e8eb0ca253059cb98eb794629aafff62be635a46bc61015b16e8815d3 diff --git a/zabbix-out-of-tree.patch b/zabbix-out-of-tree.patch index 901d716..01f9068 100644 --- a/zabbix-out-of-tree.patch +++ b/zabbix-out-of-tree.patch @@ -1,5 +1,18 @@ +diff --git a/configure.ac b/configure.ac +index 3bf77ab..aa050ef 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -24,7 +24,7 @@ AC_PROG_MAKE_SET + + AC_CONFIG_HEADERS(include/common/config.h) + +-AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include']) ++AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include']) + + AC_CANONICAL_HOST + diff --git a/src/go/Makefile.am b/src/go/Makefile.am -index 3e24aa0..308e34b 100644 +index 3e24aa0..e1fac61 100644 --- a/src/go/Makefile.am +++ b/src/go/Makefile.am @@ -67,6 +67,7 @@ clean: clean-go-build clean-sbom @@ -23,7 +36,7 @@ index 3e24aa0..308e34b 100644 $(INSTALL_DATA) $${_f} "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"; \ done) diff --git a/src/zabbix_agent/Makefile.am b/src/zabbix_agent/Makefile.am -index b217fb5..945a673 100644 +index b217fb5..1afa36b 100644 --- a/src/zabbix_agent/Makefile.am +++ b/src/zabbix_agent/Makefile.am @@ -69,4 +69,4 @@ zabbix_agentd_CFLAGS = \ @@ -33,16 +46,17 @@ index b217fb5..945a673 100644 - test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "../../conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" + test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" diff --git a/src/zabbix_java/Makefile.am b/src/zabbix_java/Makefile.am -index 43f8f19..48214c9 100644 +index 7b410ed..b3bb5b9 100644 --- a/src/zabbix_java/Makefile.am +++ b/src/zabbix_java/Makefile.am -@@ -9,22 +9,22 @@ EXTRA_DIST = \ +@@ -9,23 +9,23 @@ EXTRA_DIST = \ startup.sh ZJG = bin/zabbix-java-gateway-$(VERSION).jar --LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.2.9.jar:lib/logback-classic-1.2.9.jar:lib/slf4j-api-1.7.32.jar +-LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar ++LIB = $(srcdir)/lib/android-json-4.3_r3.1.jar:$(srcdir)/lib/logback-core-1.5.16.jar:$(srcdir)/lib/logback-classic-1.5.16.jar:$(srcdir)/lib/slf4j-api-2.0.16.jar + -JUNIT = tests/junit-4.8.2.jar -+LIB = $(srcdir)/lib/android-json-4.3_r3.1.jar:$(srcdir)/lib/logback-core-1.2.3.jar:$(srcdir)/lib/logback-classic-1.2.3.jar:$(srcdir)/lib/slf4j-api-1.7.30.jar +JUNIT = $(srcdir)/tests/junit-4.8.2.jar ZJG_DEST = $(DESTDIR)$(sbindir)/zabbix_java @@ -60,16 +74,16 @@ index 43f8f19..48214c9 100644 chmod 600 tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password - $(JAVAC) tests/com/zabbix/gateway/jmx_test_beans/*.java - $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) tests/com/zabbix/gateway/*.java -+ $(JAVAC) tests/com/zabbix/gateway/jmx_$(srcdir)/test_beans/*.java ++ $(JAVAC) $(srcdir)/tests/com/zabbix/gateway/jmx_test_beans/*.java + $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) $(srcdir)/tests/com/zabbix/gateway/*.java java -classpath class/tests:$(LIB):$(ZJG):$(JUNIT) com.zabbix.gateway.AllTestRunner class: diff --git a/src/zabbix_js/Makefile.am b/src/zabbix_js/Makefile.am -index 1e4fd93..2110656 100644 +index 1e4fd93..534db83 100644 --- a/src/zabbix_js/Makefile.am +++ b/src/zabbix_js/Makefile.am -@@ -5,30 +5,30 @@ +@@ -5,30 +5,30 @@ bin_PROGRAMS = zabbix_js zabbix_js_SOURCES = zabbix_js.c zabbix_js_LDADD = \ @@ -125,7 +139,7 @@ index 1e4fd93..2110656 100644 zabbix_js_LDADD += @ZBXJS_LIBS@ $(LIBXML2_LIBS) diff --git a/src/zabbix_proxy/Makefile.am b/src/zabbix_proxy/Makefile.am -index b56f8a8..44800a0 100644 +index b56f8a8..4c7dcf6 100644 --- a/src/zabbix_proxy/Makefile.am +++ b/src/zabbix_proxy/Makefile.am @@ -151,4 +151,4 @@ install-data-hook: @@ -135,7 +149,7 @@ index b56f8a8..44800a0 100644 - test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "../../conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" + test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" diff --git a/src/zabbix_server/Makefile.am b/src/zabbix_server/Makefile.am -index 0a55934..a7f6a28 100644 +index 0a55934..61ce877 100644 --- a/src/zabbix_server/Makefile.am +++ b/src/zabbix_server/Makefile.am @@ -186,4 +186,4 @@ install-data-hook: @@ -144,14 +158,3 @@ index 0a55934..a7f6a28 100644 $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" - test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "../../conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" + test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" ---- zabbix-7.0.3/configure.ac.out-of-tree 2024-08-19 14:38:13.426482392 -0600 -+++ zabbix-7.0.3/configure.ac 2024-08-19 14:40:30.842129965 -0600 -@@ -24,7 +24,7 @@ - - AC_CONFIG_HEADERS(include/common/config.h) - --AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include']) -+AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include']) - - AC_CANONICAL_HOST - diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 789a98a..154eb60 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.7 +Version: 7.0.9 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -872,6 +872,9 @@ fi %files web-pgsql %changelog +* Wed Jan 29 2025 Orion Poplawski - 7.0.9-1 +- Update to 7.0.9 + * Sat Dec 21 2024 Orion Poplawski - 7.0.7-1 - Update to 7.0.7 From 374eee1d5d287966ff1f4209095cbdc299f52d05 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Tue, 18 Feb 2025 09:38:40 -0700 Subject: [PATCH 06/16] Re-install SELinux module in %%posttrans to address "upgrade" from zabbixA.B to zabbixX.Y in one transaction --- zabbix7.0.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 154eb60..a74dc00 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -17,7 +17,7 @@ Name: zabbix%{majver} Version: 7.0.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Open-source monitoring solution for your IT infrastructure # TODO - Note additional licenses in src/go when we start building with go @@ -682,6 +682,8 @@ if [ $1 -eq 0 ]; then fi %posttrans selinux +# This handles the "upgrade" from zabbixA.B to zabbixX.Y in one transaction +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2 %selinux_relabel_post -s %{selinuxtype} %endif @@ -872,6 +874,10 @@ fi %files web-pgsql %changelog +* Tue Feb 18 2025 Orion Poplawski - 7.0.9-2 +- Re-install SELinux module in %%posttrans to address "upgrade" from zabbixA.B + to zabbixX.Y in one transaction + * Wed Jan 29 2025 Orion Poplawski - 7.0.9-1 - Update to 7.0.9 From 9f1c6d1e1edbe39686be09f537b9d335e90b654d Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 2 Apr 2025 16:16:07 -0600 Subject: [PATCH 07/16] Update to 7.0.11 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ba6e998..1bd367a 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /zabbix-7.0.4.tar.gz /zabbix-7.0.7.tar.gz /zabbix-7.0.9.tar.gz +/zabbix-7.0.11.tar.gz diff --git a/sources b/sources index adfc58a..e7ceb73 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.9.tar.gz) = 7ff18b69b93fa6d06e1ee8494084b4054f059dfd16c2af776f9347c6e14ad16ce61e328e8eb0ca253059cb98eb794629aafff62be635a46bc61015b16e8815d3 +SHA512 (zabbix-7.0.11.tar.gz) = a715f7b30e9ed6b1a626e9d0e49ec302716eb4da33bd4a5853ecbe8392ebe3177c7437b70989c6d25ff3406be53c8c0c8ca0813d8ee926c8ba48a4795fe73762 diff --git a/zabbix7.0.spec b/zabbix7.0.spec index a74dc00..a89a716 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,8 +16,8 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.9 -Release: 2%{?dist} +Version: 7.0.11 +Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure # TODO - Note additional licenses in src/go when we start building with go @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Wed Apr 02 2025 Orion Poplawski - 7.0.11-1 +- Update to 7.0.11 + * Tue Feb 18 2025 Orion Poplawski - 7.0.9-2 - Re-install SELinux module in %%posttrans to address "upgrade" from zabbixA.B to zabbixX.Y in one transaction From d29ec443092808fb81ce46d0b07aed9b25db811b Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 2 Apr 2025 16:24:26 -0600 Subject: [PATCH 08/16] Add CVE numbers --- zabbix7.0.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zabbix7.0.spec b/zabbix7.0.spec index a89a716..7528ba1 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -875,14 +875,14 @@ fi %changelog * Wed Apr 02 2025 Orion Poplawski - 7.0.11-1 -- Update to 7.0.11 +- Update to 7.0.11 (CVE-2024-45700) * Tue Feb 18 2025 Orion Poplawski - 7.0.9-2 - Re-install SELinux module in %%posttrans to address "upgrade" from zabbixA.B to zabbixX.Y in one transaction * Wed Jan 29 2025 Orion Poplawski - 7.0.9-1 -- Update to 7.0.9 +- Update to 7.0.9 (CVE-2024-36465, CVE-2024-36469, CVE-2024-42325, CVE-2024-45699) * Sat Dec 21 2024 Orion Poplawski - 7.0.7-1 - Update to 7.0.7 From abda58115188fd5843e2ff35b63fe24065613994 Mon Sep 17 00:00:00 2001 From: Morten Stevens Date: Mon, 7 Jul 2025 22:50:28 +0200 Subject: [PATCH 09/16] 7.0.16 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1bd367a..9ec59a9 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /zabbix-7.0.7.tar.gz /zabbix-7.0.9.tar.gz /zabbix-7.0.11.tar.gz +/zabbix-7.0.16.tar.gz diff --git a/sources b/sources index e7ceb73..0c6087a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.11.tar.gz) = a715f7b30e9ed6b1a626e9d0e49ec302716eb4da33bd4a5853ecbe8392ebe3177c7437b70989c6d25ff3406be53c8c0c8ca0813d8ee926c8ba48a4795fe73762 +SHA512 (zabbix-7.0.16.tar.gz) = 9a4b22d55ffaac09cec8aff0c906c2d75cc3eeac12d4efa726865e9a7d70d778367cc22e481455fbc507cb1d7157bb76743e3750d4ccbb8a2c0a3e922f07e86f diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 7528ba1..1606ff0 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.11 +Version: 7.0.16 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Mon Jul 07 2025 Morten Stevens - 7.0.16-1 +- Update to 7.0.16 + * Wed Apr 02 2025 Orion Poplawski - 7.0.11-1 - Update to 7.0.11 (CVE-2024-45700) From 7a5be5a8f748f563de011bca5acae41f6c483a8d Mon Sep 17 00:00:00 2001 From: Morten Stevens Date: Wed, 27 Aug 2025 10:29:29 +0200 Subject: [PATCH 10/16] 7.0.18 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9ec59a9..35da4f6 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /zabbix-7.0.9.tar.gz /zabbix-7.0.11.tar.gz /zabbix-7.0.16.tar.gz +/zabbix-7.0.18.tar.gz diff --git a/sources b/sources index 0c6087a..b4f1cf3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.16.tar.gz) = 9a4b22d55ffaac09cec8aff0c906c2d75cc3eeac12d4efa726865e9a7d70d778367cc22e481455fbc507cb1d7157bb76743e3750d4ccbb8a2c0a3e922f07e86f +SHA512 (zabbix-7.0.18.tar.gz) = cb3530ee122aac0df1d969192bff6721b00560acabbc97877f1323e717def04f8111a42109289d881ca059364b33bcf1b5a7e5549ee33b3375a9a8956d5b354d diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 1606ff0..ef87cd8 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.16 +Version: 7.0.18 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Wed Aug 27 2025 Morten Stevens - 7.0.18-1 +- Update to 7.0.18 + * Mon Jul 07 2025 Morten Stevens - 7.0.16-1 - Update to 7.0.16 From 0432ccaf4472109632486172975d01b2011243cf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Aug 2025 16:19:13 +0000 Subject: [PATCH 11/16] Revert request: pagure.io/releng/issue/12915 Revert "Merge branch 'rawhide' into epel10" This reverts commit 68228950216a92922ed1a3cb3aac9fc08042172f, reversing changes made to abda58115188fd5843e2ff35b63fe24065613994. --- README.md | 3 +++ dead.package | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 README.md delete mode 100644 dead.package diff --git a/README.md b/README.md new file mode 100644 index 0000000..fd3a755 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# zabbix7.0 + +The zabbix7.0 package diff --git a/dead.package b/dead.package deleted file mode 100644 index 4f605e1..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -EPEL-only package From 7ab2528950a73f45beea071ab119fab71da173e3 Mon Sep 17 00:00:00 2001 From: Morten Stevens Date: Thu, 30 Oct 2025 15:38:12 +0100 Subject: [PATCH 12/16] 7.0.20 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 35da4f6..b9cfc60 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /zabbix-7.0.11.tar.gz /zabbix-7.0.16.tar.gz /zabbix-7.0.18.tar.gz +/zabbix-7.0.20.tar.gz diff --git a/sources b/sources index b4f1cf3..b9857b6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.18.tar.gz) = cb3530ee122aac0df1d969192bff6721b00560acabbc97877f1323e717def04f8111a42109289d881ca059364b33bcf1b5a7e5549ee33b3375a9a8956d5b354d +SHA512 (zabbix-7.0.20.tar.gz) = ef83bfc80f33b3cae73de4c8076f2d41e09915b8e6fd29b945586cd6ec1b097007e14a26ff154c0435c299200b347ad938b75466bd824a9f9e83f8798fd871eb diff --git a/zabbix7.0.spec b/zabbix7.0.spec index ef87cd8..c4afc84 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.18 +Version: 7.0.20 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Thu Oct 30 2025 Morten Stevens - 7.0.20-1 +- Update to 7.0.20 + * Wed Aug 27 2025 Morten Stevens - 7.0.18-1 - Update to 7.0.18 From b795ec1465482db4863387b3770c044475846a10 Mon Sep 17 00:00:00 2001 From: Morten Stevens Date: Wed, 17 Dec 2025 20:13:08 +0100 Subject: [PATCH 13/16] 7.0.22 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b9cfc60..398ee45 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /zabbix-7.0.16.tar.gz /zabbix-7.0.18.tar.gz /zabbix-7.0.20.tar.gz +/zabbix-7.0.22.tar.gz diff --git a/sources b/sources index b9857b6..42ad043 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.20.tar.gz) = ef83bfc80f33b3cae73de4c8076f2d41e09915b8e6fd29b945586cd6ec1b097007e14a26ff154c0435c299200b347ad938b75466bd824a9f9e83f8798fd871eb +SHA512 (zabbix-7.0.22.tar.gz) = 476016cfef14c960a688594033956d380e9effbfabd96b31f24d558c83c36c98af64f747af7711c832c13b203536824838242e6d7dbe0e2ba3bb7fbcf4e5ed11 diff --git a/zabbix7.0.spec b/zabbix7.0.spec index c4afc84..84d59e6 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.20 +Version: 7.0.22 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Wed Dec 17 2025 Morten Stevens - 7.0.22-1 +- Update to 7.0.22 + * Thu Oct 30 2025 Morten Stevens - 7.0.20-1 - Update to 7.0.20 From 5858906d3175a8cf744ce3bdac90b801844b2f72 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 6 Mar 2026 20:05:01 -0700 Subject: [PATCH 14/16] Update to 7.0.23 --- .gitignore | 1 + sources | 2 +- zabbix7.0.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 398ee45..b133c5e 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /zabbix-7.0.18.tar.gz /zabbix-7.0.20.tar.gz /zabbix-7.0.22.tar.gz +/zabbix-7.0.23.tar.gz diff --git a/sources b/sources index 42ad043..5050553 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.22.tar.gz) = 476016cfef14c960a688594033956d380e9effbfabd96b31f24d558c83c36c98af64f747af7711c832c13b203536824838242e6d7dbe0e2ba3bb7fbcf4e5ed11 +SHA512 (zabbix-7.0.23.tar.gz) = 11ed3a95d3dfd07ad9de7dd7754fbec114e08722f0422f0c67f95c82a9e9db07c199ef4d43927c18294af00759cef66f789ea75bc7b9eae7439f79778aeea314 diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 84d59e6..07786b4 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.22 +Version: 7.0.23 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Sat Mar 07 2026 Orion Poplawski - 7.0.23-1 +- Update to 7.0.23 + * Wed Dec 17 2025 Morten Stevens - 7.0.22-1 - Update to 7.0.22 From bd6f319f4fa3e3558e6c5651556563e77e833105 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 6 May 2026 20:09:17 -0600 Subject: [PATCH 15/16] Update to 7.0.26 (CVE-2026-23927, CVE-2026-23928) --- .gitignore | 1 + sources | 2 +- zabbix-out-of-tree.patch | 4 ++-- zabbix7.0.spec | 5 ++++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b133c5e..5a632ef 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /zabbix-7.0.20.tar.gz /zabbix-7.0.22.tar.gz /zabbix-7.0.23.tar.gz +/zabbix-7.0.26.tar.gz diff --git a/sources b/sources index 5050553..9153fb3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.23.tar.gz) = 11ed3a95d3dfd07ad9de7dd7754fbec114e08722f0422f0c67f95c82a9e9db07c199ef4d43927c18294af00759cef66f789ea75bc7b9eae7439f79778aeea314 +SHA512 (zabbix-7.0.26.tar.gz) = b615bc09eaeca0880579bdab8e002d8a0af7d0ef6cead056261d0326df6763fe1aea3619e8e94ea53243f9d33dc2665a0d0b55032bf2031556fff0813ccf0bb8 diff --git a/zabbix-out-of-tree.patch b/zabbix-out-of-tree.patch index 01f9068..9ffc3a0 100644 --- a/zabbix-out-of-tree.patch +++ b/zabbix-out-of-tree.patch @@ -91,7 +91,6 @@ index 1e4fd93..534db83 100644 - $(top_srcdir)/src/libs/zbxembed/libzbxembed.a \ - $(top_srcdir)/src/libs/zbxjson/libzbxjson.a \ - $(top_srcdir)/src/libs/zbxregexp/libzbxregexp.a \ -- $(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \ - $(top_srcdir)/src/libs/zbxthreads/libzbxthreads.a \ - $(top_srcdir)/src/libs/zbxmutexs/libzbxmutexs.a \ - $(top_srcdir)/src/libs/zbxprof/libzbxprof.a \ @@ -105,6 +104,7 @@ index 1e4fd93..534db83 100644 - $(top_srcdir)/src/libs/zbxhttp/libzbxhttp.a \ - $(top_srcdir)/src/libs/zbxvariant/libzbxvariant.a \ - $(top_srcdir)/src/libs/zbxxml/libzbxxml.a \ +- $(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \ - $(top_srcdir)/src/libs/zbxstr/libzbxstr.a \ - $(top_srcdir)/src/libs/zbxnum/libzbxnum.a \ - $(top_srcdir)/src/libs/zbxtime/libzbxtime.a \ @@ -115,7 +115,6 @@ index 1e4fd93..534db83 100644 + $(top_builddir)/src/libs/zbxembed/libzbxembed.a \ + $(top_builddir)/src/libs/zbxjson/libzbxjson.a \ + $(top_builddir)/src/libs/zbxregexp/libzbxregexp.a \ -+ $(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \ + $(top_builddir)/src/libs/zbxthreads/libzbxthreads.a \ + $(top_builddir)/src/libs/zbxmutexs/libzbxmutexs.a \ + $(top_builddir)/src/libs/zbxprof/libzbxprof.a \ @@ -129,6 +128,7 @@ index 1e4fd93..534db83 100644 + $(top_builddir)/src/libs/zbxhttp/libzbxhttp.a \ + $(top_builddir)/src/libs/zbxvariant/libzbxvariant.a \ + $(top_builddir)/src/libs/zbxxml/libzbxxml.a \ ++ $(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \ + $(top_builddir)/src/libs/zbxstr/libzbxstr.a \ + $(top_builddir)/src/libs/zbxnum/libzbxnum.a \ + $(top_builddir)/src/libs/zbxtime/libzbxtime.a \ diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 07786b4..00eec16 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.23 +Version: 7.0.26 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Thu May 07 2026 Orion Poplawski - 7.0.26-1 +- Update to 7.0.26 (CVE-2026-23927, CVE-2026-23928) + * Sat Mar 07 2026 Orion Poplawski - 7.0.23-1 - Update to 7.0.23 From 41396c5ee74ffe88b1bc280f2dd287bf602ff5e5 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 10 Jul 2026 11:43:32 -0600 Subject: [PATCH 16/16] Update to 7.0.28 --- .gitignore | 1 + sources | 2 +- zabbix-out-of-tree.patch | 2 +- zabbix7.0.spec | 5 ++++- 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5a632ef..230b30d 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /zabbix-7.0.22.tar.gz /zabbix-7.0.23.tar.gz /zabbix-7.0.26.tar.gz +/zabbix-7.0.28.tar.gz diff --git a/sources b/sources index 9153fb3..03962c7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.0.26.tar.gz) = b615bc09eaeca0880579bdab8e002d8a0af7d0ef6cead056261d0326df6763fe1aea3619e8e94ea53243f9d33dc2665a0d0b55032bf2031556fff0813ccf0bb8 +SHA512 (zabbix-7.0.28.tar.gz) = 5ad2e672393cfb1c6142515b343c8f4d1a0ed0e7634abae84dc597c9a47146a046401dfe7dab1953adf8ce0c4a053015094bde937a3e22186b23fb573ee6bafb diff --git a/zabbix-out-of-tree.patch b/zabbix-out-of-tree.patch index 9ffc3a0..8d79541 100644 --- a/zabbix-out-of-tree.patch +++ b/zabbix-out-of-tree.patch @@ -53,7 +53,7 @@ index 7b410ed..b3bb5b9 100644 startup.sh ZJG = bin/zabbix-java-gateway-$(VERSION).jar --LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar +-LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar:lib/dnsjava-3.6.4.jar +LIB = $(srcdir)/lib/android-json-4.3_r3.1.jar:$(srcdir)/lib/logback-core-1.5.16.jar:$(srcdir)/lib/logback-classic-1.5.16.jar:$(srcdir)/lib/slf4j-api-2.0.16.jar -JUNIT = tests/junit-4.8.2.jar diff --git a/zabbix7.0.spec b/zabbix7.0.spec index 00eec16..862f195 100644 --- a/zabbix7.0.spec +++ b/zabbix7.0.spec @@ -16,7 +16,7 @@ %global majver 7.0 Name: zabbix%{majver} -Version: 7.0.26 +Version: 7.0.28 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure @@ -874,6 +874,9 @@ fi %files web-pgsql %changelog +* Fri Jul 10 2026 Orion Poplawski - 7.0.28-1 +- Update to 7.0.28 + * Thu May 07 2026 Orion Poplawski - 7.0.26-1 - Update to 7.0.26 (CVE-2026-23927, CVE-2026-23928)